How many SolarWinds observability self-hosted CVEs are in CISA KEV?

None of SolarWinds observability self-hosted's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which versions of SolarWinds observability self-hosted are affected?

14 distinct SolarWinds observability self-hosted versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in SolarWinds observability self-hosted CVEs?

SolarWinds observability self-hosted's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-601 (URL Redirection to Untrusted Site ('Open Redirect')), CWE-502 (Deserialization of Untrusted Data), CWE-345 (Insufficient Verification of Data Authenticity).

What is the average severity of SolarWinds observability self-hosted CVEs?

The average CVSS base score across SolarWinds observability self-hosted's scored CVEs is 6.9.

RadicalNotion.AI

Log in Create an account

SolarWinds

11 CVEs

SolarWinds observability self-hosted Vulnerabilities

Name: SolarWinds observability self-hosted vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for observability self-hosted by SolarWinds.

11

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

0

Public exploits

PoC or exploit code

6.9

Avg CVSS

2025–2026

Last updated September 22, 2026

Overview

SolarWinds observability self-hosted has 11 published CVE records since 2025, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 0 have a known public exploit. The average CVSS base score across scored CVEs is 6.9. Affected platforms include windows.

Severity and exploitation

How the CVSS severity of SolarWinds observability self-hosted's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical1

High5

Medium5

Low0

In CISA’s Known Exploited Vulnerabilities catalog

0

None of SolarWinds observability self-hosted's CVEs are currently listed in CISA's KEV catalog.

Public exploits

0

No SolarWinds observability self-hosted CVEs currently have a tracked public exploit.

Affected versions and CVEs

Browse every SolarWinds observability self-hosted version named in a CVE, then pick one to see only the CVEs that affect it.

Version ranges

< 2025.22 CVEs
< 2025.4.12 CVEs
< 2026.1.12 CVEs
< 2026.2.32 CVEs
< 2025.2.11 CVE
< 2025.41 CVE
>= 2025.2.1 and below1 CVE
>= 2026.1 and previous versions1 CVE

Fixed in

2025.22 CVEs
2025.4.12 CVEs
2026.1.12 CVEs
2026.2.32 CVEs
2025.2.11 CVE
2025.41 CVE

Find a version

11 CVEs

Sort

SolarWinds Observability Self-Hosted Unauthenticated Remote Code Execution Vulnerability
CVE-2026-28325
Patch
CWE-502
High · CVSS 8.8
EPSS 1.5% (74th pct)2026-09-22
SolarWinds Observability Self-Hosted Remote Code Execution Vulnerability
CVE-2026-28324
Patch
Workaround
CWE-345
Critical · CVSS 9.8
EPSS 0.7% (50th pct)2026-09-22
SolarWinds Observability Self-Hosted Open Redirect Vulnerability
CVE-2026-28301
Patch
CWE-601
Medium · CVSS 4.8
EPSS 0.4% (28th pct)2026-06-09
SolarWinds Observability Self-Hosted Stored Cross-Site Scripting Vulnerability
CVE-2026-28298
Patch
CWE-79
High · CVSS 8.1
EPSS 0.4% (34th pct)2026-03-26
SolarWinds Observability Self-Hosted Stored Cross-Site Scripting Vulnerability
CVE-2026-28297
Patch
CWE-79
High · CVSS 8.7
EPSS 0.4% (37th pct)2026-03-26
SolarWinds Observability Self-Hosted Open Redirection Vulnerability
CVE-2025-40545
Patch
CWE-601
Medium · CVSS 4.8
EPSS 0.2% (13th pct)2025-11-18
SolarWinds Observability Self-Hosted XSS Vulnerability
CVE-2025-26391
Patch
CWE-79
Medium · CVSS 5.4
EPSS 0.3% (19th pct)2025-11-18
SolarWinds Observability Self-Hosted SQL Injection Vulnerability
CVE-2025-26392
Patch
CWE-89
Medium · CVSS 5.4
EPSS 0.2% (14th pct)2025-10-21
SolarWinds Observability Self-Hosted Deserialization of Untrusted Data Local Privilege Escalation Vulnerability
CVE-2025-26397
Patch
CWE-502
High · CVSS 7.8
EPSS 0.3% (25th pct)2025-07-24
SolarWinds SWOSH DOM-based reflective XSS Vulnerability
CVE-2025-26395
Patch
CWE-79
High · CVSS 7.1
EPSS 0.2% (10th pct)2025-06-10
SolarWinds SWOSH Open Redirection Vulnerability
CVE-2025-26394
Patch
CWE-601
Medium · CVSS 4.8
EPSS 0.2% (8th pct)2025-06-10

Common weakness types

The CWE weakness categories most often found in SolarWinds observability self-hosted CVEs. Follow any weakness for its full explanation.

Disclosure activity by year

How many SolarWinds observability self-hosted CVEs were published each year.

2025

6

2026

5

Other SolarWinds products

Browse vulnerabilities for other products by SolarWinds.

serv-u55 CVEs orion platform51 CVEs SolarWinds Platform45 CVEs Access Rights Manager33 CVEs Web Help Desk23 CVEs serv-u file server21 CVEs serv-u ftp server12 CVEs database performance analyzer11 CVEs

All SolarWinds vulnerabilities

Frequently asked questions

Common questions about SolarWinds observability self-hosted vulnerabilities.

How many CVEs does SolarWinds observability self-hosted have?: SolarWinds observability self-hosted has 11 published CVE records since 2025.
How many SolarWinds observability self-hosted CVEs are in CISA KEV?: None of SolarWinds observability self-hosted's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Are there public exploits for SolarWinds observability self-hosted vulnerabilities?: No SolarWinds observability self-hosted CVEs currently have a tracked public exploit in this dataset.
Which versions of SolarWinds observability self-hosted are affected?: 14 distinct SolarWinds observability self-hosted versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in SolarWinds observability self-hosted CVEs?: SolarWinds observability self-hosted's CVEs most often map to these CWE weakness types: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')), CWE-601 (URL Redirection to Untrusted Site ('Open Redirect')), CWE-502 (Deserialization of Untrusted Data), CWE-345 (Insufficient Verification of Data Authenticity).
How many critical SolarWinds observability self-hosted vulnerabilities are there?: SolarWinds observability self-hosted has 1 critical and 5 high-severity CVEs.
What is the average severity of SolarWinds observability self-hosted CVEs?: The average CVSS base score across SolarWinds observability self-hosted's scored CVEs is 6.9.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track SolarWinds observability self-hosted vulnerabilities

Get an alert for each new SolarWinds observability self-hosted CVE, with AI-written analysis and remediation steps.

Create an account See pricing