CVE-2026-28298

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

SolarWinds Observability Self-Hosted was found to be affected by a stored cross-site scripting vulnerability, which when exploited, can lead to unintended script execution.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Mar 26, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-282997.5SolarWinds Web Help Desk is found to be affected by a denial-of-service vulnerability, which when exploited, could cause the Web Help Desk sCVE-2026-28306.1The WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets plugin for WordPress is vulnerable to Reflected Cross-Site ScriptCVE-2026-283014.8A vulnerability in which an attacker can provide a crafted external URL that may redirect a user to an unintended website.CVE-2026-283029.1SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation and remote cCVE-2026-283049.1SolarWinds Serv-U is affected by a remote code execution vulnerability that, when exploited, can allow the arbitrary execution of code remotCVE-2026-283059.1SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution as root. A CVE-2026-283069.1SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to elevate their privileges to a syCVE-2026-283079.1SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain user group to be elevated into an administrator gCVE-2026-283089.1SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution. Domain admCVE-2026-283099.1SolarWinds Serv-U is affected by a broken access control vulnerability that allows a domain administrator to create system administrator accCVE-2026-28314.9The MailArchiver plugin for WordPress is vulnerable to SQL Injection via the ‘logid’ parameter in all versions up to, and including, 4.5.0 dCVE-2026-283109.1SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to escalate their user type to that
CVE-2026-28298: High severity, CVSS 8.1 | Vulnix