How do I check whether I am affected by CVE-2026-28328?

In the SolarWinds Platform web console, open Settings > All Settings > Product/Module Details (or the footer version) and read the Observability Self-Hosted version. 2026.2.3 or lower is affected. Exact menu path not verified.

What is the fix for CVE-2026-28328?

Upgrade SolarWinds Observability Self-Hosted to 2026.4 or later. Until then, limit who holds low-privileged accounts and review their activity.

Who is not affected by CVE-2026-28328?

Not affected if: managed-hosting.

Live › vulnerability › CVE-2026-28328

Go to dashboard

high8.8Infrastructure

SolarWinds Observability Self-Hosted: broken authorization lets low-privileged users change data

SolarWinds Observability Self-Hosted 2026.2.3 and earlier has a broken authorization flaw (CWE-863): a low-privileged authenticated user can read and modify data beyond their permissions. CVSS 8.8. Fixed in 2026.4.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

8.8

high

scored by [email protected]

known so far5 of 6

missing: exploitation

First public: Oct 20, 2026 UTC
Last modified: Oct 24, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Yes.
Needs a special setup: Not known from the sources.
Reachable from: network.
Worst case: Low-privileged user reads and modifies data beyond their permissions.
CVSS said: 8.8. The facts above say low; we keep the sources' high until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-28328

Go to dashboard

high8.8Infrastructure

SolarWinds Observability Self-Hosted: broken authorization lets low-privileged users change data

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

8.8

high

scored by [email protected]

known so far5 of 6

missing: exploitation

First public: Oct 20, 2026 UTC
Last modified: Oct 24, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is high, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Yes.
Needs a special setup: Not known from the sources.
Reachable from: network.
Worst case: Low-privileged user reads and modifies data beyond their permissions.
CVSS said: 8.8. The facts above say low; we keep the sources' high until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

SolarWinds Observability Self-Hosted: broken authorization lets low-privileged users change data

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

SolarWinds Observability Self-Hosted: broken authorization lets low-privileged users change data

Why it is high, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources