CVE-2026-28331

MediumCVSS 4.4/10Last modified Oct 20, 2026

Description

SolarWinds Patch Manager exposes sensitive information accessible to local users, which could be used to gain elevated privileges.

Metrics

CVSS 3.1 4.4/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
SolarWindsPatch Manager2026.2 and all previous versions

References

Timeline

Published
Oct 20, 2026
Last modified
Oct 20, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-283358.4SolarWinds Dameware was found to be affected by a buffer overflow vulnerability that can result in remote code execution. Authentication is CVE-2026-283369.9SolarWinds Dameware was found to be affected by a command injection vulnerability that could lead to the compromise of the remotely controllCVE-2026-283386.1PMD is an extensible multilanguage static code analyzer. Prior to version 7.22.0, PMD's `vbhtml` and `yahtml` report formats insert rule vioCVE-2026-28347.2The Age Verification & Identity Verification by Token of Trust plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘deCVE-2026-283427.5OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.10.2, the PasswordHash API endpoint allows unCVE-2026-283436.1CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. Starting in version 29.0.0 and prior to version 47.6.0, a crossCVE-2026-283486.1lxml_html_clean is a project for HTML cleaning functionalities copied from `lxml.html.clean`. Prior to version 0.4.4, the _has_sneaky_javascCVE-2026-28359.1An HTTP Request Smuggling vulnerability (CWE-444) has been found in Pingora's parsing of HTTP/1.0 and Transfer-Encoding requests. The issue CVE-2026-283506.1lxml_html_clean is a project for HTML cleaning functionalities copied from `lxml.html.clean`. Prior to version 0.4.4, the <base> tag passes CVE-2026-283515.3pypdf is a free and open-source pure-python PDF library. Prior to version 6.7.4, an attacker who uses this vulnerability can craft a PDF whiCVE-2026-283526.5Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In versions prior to 3.3.11CVE-2026-2835310.0Trivy Vulnerability Scanner is a VS Code extension that helps find vulnerabilities. In Trivy VSCode Extension version 1.8.12, which was dist
CVE-2026-28331: Medium severity, CVSS 4.4 | Vulnix