CVE-2026-28328

validated

GHSA-hqgx-66xg-f35h ↗EUVD-2026-105175 ↗

check availablenot proven exploitable

cve.orgpublic pockev

SolarWinds Observability Self-Hosted 2026.2.3 and all previous versions

CWE-863 Incorrect Authorization

ETK-2026-2193, permanent identifier

cvss8.8cna vendorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

+1h01mTTV

17mAI analysis

Check if you are vulnerable

timeline

0 = cve.org publication

trigger signal (cve.org) +0mcheck available+61magent stopped

+15min

+30min

+45min

description

SolarWinds Observability Self-Hosted has an authorization-control flaw. A user with limited permissions may be able to view or modify information beyond the access they were assigned.

mitigation

Restrict access to the deployment to trusted users, remove unnecessary low-privilege accounts, and review authorization-related activity for unexpected access. Apply a vendor update when SolarWinds publishes a fixed release; no fixed version is recorded in the available advisory data.

check

available

exploit

automation

contextual

auth required

yes, low privileges

EPSS

–

agent run time

17m

cve.org record, t = 0

2026-10-20 16:17Z

Δ to public poc

–

Δ to kev

–

outcome

Contextual check: a technique exists and was validated, but no deterministic check could cover this one.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-10-20 16:17Z
cve_org: trigger signal, started the run
https://www.cve.org/CVERecord?id=CVE-2026-28328

this entry in the feed

GET /api/v1/feed/CVE-2026-28328

{
  "etk_id": "ETK-2026-2193",
  "cve_id": "CVE-2026-28328",
  "display_id": "CVE-2026-28328",
  "ghsa_id": "GHSA-hqgx-66xg-f35h",
  "euvd_id": "EUVD-2026-105175",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Broken authorization in SolarWinds Observability Self-Hosted",
  "summary": "SolarWinds Observability Self-Hosted has an authorization-control flaw. A user with limited permissions may be able to view or modify information beyond the access they were assigned.",
  "mitigation": "Restrict access to the deployment to trusted users, remove unnecessary low-privilege accounts, and review authorization-related activity for unexpected access. Apply a vendor update when SolarWinds publishes a fixed release; no fixed version is recorded in the available advisory data.",
  "vendor": "SolarWinds",
  "product": "SolarWinds Observability Self-Hosted",
  "affected": [
    {
      "affected_notes": [
        "2026.2.3 and all previous versions"
      ],
      "affected_ranges": [],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "SolarWinds Observability Self-Hosted",
      "purl": null
    }
  ],
  "cwes": [
    863
  ],
  "cvss_score": 8.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 16.824922633333333,
  "t0_at": "2026-10-20T16:17:18.712000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-20T17:18:10.549666+00:00",
      "days": 0.04226663965277778,
      "is_lower_bound": false,
      "measured_at": "2026-10-20T16:17:18.712000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-20T16:17:18.712000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-20T16:17:18.712000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28328"
    }
  }
}

published 2026-10-20 16:59Z
last change 2026-10-21 06:02Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.