CVE-2026-28322

MediumCVSS 5.6/10Last modified Oct 25, 2026

Description

SolarWinds Database Performance Analyzer was found to be affected by a stored cross-site scripting vulnerability, which when exploited, can lead to unintended script execution.

Metrics

CVSS 3.1 5.6/10CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-20

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
SolarWindsDatabase Performance Analyzer2026.1 and below

References

Timeline

Published
Jun 30, 2026
Last modified
Oct 25, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-283239.8SolarWinds Web Help Desk is found to be affected by a SAML authentication bypass vulnerability. This requires the SAML 2.0 authentication meCVE-2026-283249.8SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability due to the insufficiCVE-2026-283258.8SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability stemming from deseriCVE-2026-283268.8SolarWinds Access Rights Manager was reported to be affected by an unauthenticated remote code execution vulnerability. The issue stems fromCVE-2026-283278.2SolarWinds Dameware was found to be affected by a DLL hijacking vulnerability. The hijack occurs during installations only and requires acceCVE-2026-283288.8SolarWinds Observability Self-Hosted was found to be affected by a broken authorization schema that can allow low-privileged users to accessCVE-2026-283296.4SolarWinds Observability Self-Hosted was found to be affected by a Server-Side Request Forgery (SSRF) vulnerability that allows authenticateCVE-2026-28339.1An HTTP request smuggling vulnerability (CWE-444) was found in Pingora's handling of HTTP/1.1 connection upgrades. The issue occurs when a PCVE-2026-283304.6SolarWinds Observability Self-Hosted was found to be affected by a stored Cross-Site Scripting (XSS) vulnerability that allows authenticatedCVE-2026-283314.4SolarWinds Patch Manager exposes sensitive information accessible to local users, which could be used to gain elevated privileges.CVE-2026-283358.4SolarWinds Dameware was found to be affected by a buffer overflow vulnerability that can result in remote code execution. Authentication is CVE-2026-283369.9SolarWinds Dameware was found to be affected by a command injection vulnerability that could lead to the compromise of the remotely controll
CVE-2026-28322: Medium severity, CVSS 5.6 | Vulnix