CVE-2025-26391 - Vulnerability Details - OpenCVE

ReportizFlow

SolarWinds Observability Self-Hosted XSS Vulnerability. The SolarWinds Platform was susceptible to a XSS vulnerability that affects user-created URL fields. This vulnerability requires authentication from a low-level account.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Solarwinds	Observability Self-hosted

No data.

No data.

References

Link	Providers
https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/hco_2025-4-1_release_notes.htm
https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-26391

History

Tue, 18 Nov 2025 22:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 18 Nov 2025 14:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Solarwinds Solarwinds observability Self-hosted
Vendors & Products		Solarwinds Solarwinds observability Self-hosted

Tue, 18 Nov 2025 09:00:00 +0000

Type	Values Removed	Values Added
Description		SolarWinds Observability Self-Hosted XSS Vulnerability. The SolarWinds Platform was susceptible to a XSS vulnerability that affects user-created URL fields. This vulnerability requires authentication from a low-level account.
Title		SolarWinds Observability Self-Hosted XSS Vulnerability
Weaknesses		CWE-79
References		https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/hco_2025-4-1_release_notes.htm https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-26391
Metrics		cvssV3_1 `{'score': 5.4, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}`

MITRE

Status: PUBLISHED

Assigner: SolarWinds

Published: 2025-11-18T08:53:01.036Z

Updated: 2025-11-18T21:02:45.370Z

Reserved: 2025-02-08T00:19:09.394Z

Link: CVE-2025-26391

Vulnrichment

Updated: 2025-11-18T21:02:41.792Z

NVD

Status : Awaiting Analysis

Published: 2025-11-18T09:15:50.220

Modified: 2025-11-18T14:06:29.817

Link: CVE-2025-26391

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-26391", "assignerOrgId": "49f11609-934d-4621-84e6-e02e032104d6", "state": "PUBLISHED", "assignerShortName": "SolarWinds", "dateReserved": "2025-02-08T00:19:09.394Z", "datePublished": "2025-11-18T08:53:01.036Z", "dateUpdated": "2025-11-18T21:02:45.370Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "platforms": ["Windows"], "product": "SolarWinds Observability Self-Hosted", "vendor": "SolarWinds", "versions": [{"status": "affected", "version": "SolarWinds Observability Self-Hosted 2025.4 and prior versions"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "KPN REDteam"}], "datePublic": "2025-11-18T14:33:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "SolarWinds Observability Self-Hosted XSS Vulnerability. The SolarWinds Platform was susceptible to a XSS vulnerability that affects user-created URL fields. This vulnerability requires authentication from a low-level account. <br>"}], "value": "SolarWinds Observability Self-Hosted XSS Vulnerability. The SolarWinds Platform was susceptible to a XSS vulnerability that affects user-created URL fields. This vulnerability requires authentication from a low-level account."}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "49f11609-934d-4621-84e6-e02e032104d6", "shortName": "SolarWinds", "dateUpdated": "2025-11-18T08:53:01.036Z"}, "references": [{"url": "https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-26391"}, {"url": "https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/hco_2025-4-1_release_notes.htm"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "SolarWinds recommends that customers upgrade to SolarWinds Observability Self-Hosted 2025.4 SR1<br>"}], "value": "SolarWinds recommends that customers upgrade to SolarWinds Observability Self-Hosted 2025.4 SR1"}], "source": {"discovery": "UNKNOWN"}, "title": "SolarWinds Observability Self-Hosted XSS Vulnerability", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-18T21:02:37.387910Z", "id": "CVE-2025-26391", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-18T21:02:45.370Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-26391", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-18T21:02:37.387910Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-18T21:02:41.792Z"}}], "cna": {"title": "SolarWinds Observability Self-Hosted XSS Vulnerability", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "KPN REDteam"}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SolarWinds", "product": "SolarWinds Observability Self-Hosted", "versions": [{"status": "affected", "version": "SolarWinds Observability Self-Hosted 2025.4 and prior versions"}], "platforms": ["Windows"], "defaultStatus": "affected"}], "solutions": [{"lang": "en", "value": "SolarWinds recommends that customers upgrade to SolarWinds Observability Self-Hosted 2025.4 SR1", "supportingMedia": [{"type": "text/html", "value": "SolarWinds recommends that customers upgrade to SolarWinds Observability Self-Hosted 2025.4 SR1<br>", "base64": false}]}], "datePublic": "2025-11-18T14:33:00.000Z", "references": [{"url": "https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-26391"}, {"url": "https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/hco_2025-4-1_release_notes.htm"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "SolarWinds Observability Self-Hosted XSS Vulnerability. The SolarWinds Platform was susceptible to a XSS vulnerability that affects user-created URL fields. This vulnerability requires authentication from a low-level account.", "supportingMedia": [{"type": "text/html", "value": "SolarWinds Observability Self-Hosted XSS Vulnerability. The SolarWinds Platform was susceptible to a XSS vulnerability that affects user-created URL fields. This vulnerability requires authentication from a low-level account. <br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "49f11609-934d-4621-84e6-e02e032104d6", "shortName": "SolarWinds", "dateUpdated": "2025-11-18T08:53:01.036Z"}}}, "cveMetadata": {"cveId": "CVE-2025-26391", "state": "PUBLISHED", "dateUpdated": "2025-11-18T21:02:45.370Z", "dateReserved": "2025-02-08T00:19:09.394Z", "assignerOrgId": "49f11609-934d-4621-84e6-e02e032104d6", "datePublished": "2025-11-18T08:53:01.036Z", "assignerShortName": "SolarWinds"}, "dataVersion": "5.2"}