CVE-2026-28329
SolarWinds Observability Self-Hosted Server-Side Request Forgery (SSRF)
SolarWinds SolarWinds Observability Self-Hosted
CVSS
6.4MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.28%Chance of exploitation activity in the next 30 days, higher than 19% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
SolarWinds Observability Self-Hosted was found to be affected by a Server-Side Request Forgery (SSRF) vulnerability that allows authenticated attackers to cause the application server to send requests to attacker-controlled or internal destinations.
Text from CVE List
Affected versions 1
- SolarWinds Observability Self-Hostedaffected: 2026.2.3 and all previous versionsCVE List
References 3
- solarwinds.com/trust-center/security-advisories/CVE-2026-28329Advisoryvia CVE List
- documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/hco_2026-4_release_notes.htmReferencevia CVE List
- documentation.solarwinds.com/en/success_center/orionplatform/content/core-secure-configuration.htmReferencevia CVE List