---
id: "CVE-2026-28331"
kind: "vulnerability"
aliases: ["CVE-2026-28331"]
title: "SolarWinds Patch Manager leaks sensitive data to local users, enabling privilege escalation"
severity: "medium"
cvss: 4.4
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["other", "solarwinds", "windows"]
not_affected_if: []
published_at: "2026-10-20T17:17:39+00:00"
first_seen_at: "2026-10-23T21:57:21+00:00"
updated_at: "2026-10-25T04:37:09+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28331", "first_seen_at": "2026-10-23T21:57:21+00:00"}]
---

# SolarWinds Patch Manager leaks sensitive data to local users, enabling privilege escalation

SolarWinds Patch Manager exposes sensitive information to any local user on the machine. The exposed data could be used by a local user to gain elevated privileges.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-23T21:57:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-28331

## From the sources

SolarWinds Patch Manager exposes sensitive information accessible to local users, which could be used to gain elevated privileges.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_