← Vulnerability feed

Vulnerability record · CVE-2025-26392 · published 21 October 2025

CVE-2025-26392: Solarwinds observability self-hosted sql injection vulnerability

Solarwinds · Observability Self Hosted

SolarWinds Observability Self-Hosted is susceptible to SQL injection vulnerability that may display sensitive data using a low-level account. This vulnerability requires authentication from a low-privilege account.

4.6 CVSS 3.1 Medium EPSS 0.24% · top 86.7% CWE-89 · SQL injection
4.6CVSS 3.1 base score
0.24%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

SolarWinds Observability Self-Hosted is susceptible to SQL injection vulnerability that may display sensitive data using a low-level account. This vulnerability requires authentication from a low-privilege account.

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/hco_2025-4_release_notes.htm Release Notes
https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-26392 PatchVendor Advisory

Track CVE-2025-26392 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.7CVE-2026-28297Solarwinds observability self-hosted cross-site scripting vulnerabilitySolarWinds Observability Self-Hosted was found to be affected by a stored cross-site scripting vulnerability, which when exploited, can lead to unint…EPSS 0.45%8.1CVE-2026-28298Solarwinds observability self-hosted cross-site scripting vulnerabilitySolarWinds Observability Self-Hosted was found to be affected by a stored cross-site scripting vulnerability, which when exploited, can lead to unint…EPSS 0.42%7.8CVE-2025-26397Solarwinds observability self-hosted deserialization of untrusted data vulnerabilitySolarWinds Observability Self-Hosted is susceptible to Deserialization of Untrusted Data Local Privilege Escalation vulnerability. An attacker with l…EPSS 0.30%5.4CVE-2025-26391Solarwinds observability self-hosted cross-site scripting vulnerabilitySolarWinds Observability Self-Hosted XSS Vulnerability. The SolarWinds Platform was susceptible to a XSS vulnerability that affects user-created URL …EPSS 0.28%4.8CVE-2025-26394Solarwinds observability self-hosted open redirect vulnerabilitySolarWinds Observability Self-Hosted is susceptible to an open redirection vulnerability. The URL is not properly sanitized, and an attacker could ma…EPSS 0.19%4.4CVE-2025-40545Solarwinds observability self-hosted open redirect vulnerabilitySolarWinds Observability Self-Hosted is susceptible to an open redirection vulnerability. The URL is not properly sanitized, and an attacker could ma…EPSS 0.23%4.3CVE-2025-26395Solarwinds observability self-hosted cross-site scripting vulnerabilitySolarWinds Observability Self-Hosted was susceptible to a cross-site scripting (XSS) vulnerability due to an unsanitized field in the URL. The attack…EPSS 0.21%9.8CVE-2026-76461Cisco AsyncOS email parsing SQL injection allows root command executionCisco AsyncOS Software for Cisco Secure Email Gateway fails to properly validate email parsing input, allowing crafted email messages containing mali…KEVEPSS 28%analysed

Source: NIST National Vulnerability Database (record CVE-2025-26392), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.