CVE-2025-26392

MEDIUM

Solarwinds Observability Self-hosted < 2025.4 - SQL Injection

Title source: rule

Description

SolarWinds Observability Self-Hosted is susceptible to SQL injection vulnerability that may display sensitive data using a low-level account. This vulnerability requires authentication from a low-privilege account.

References (2)

Scores

CVSS v3 5.4
EPSS 0.0013
EPSS Percentile 32.6%
Attack Vector ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Classification

CWE
CWE-89
Status published

Affected Products (1)

solarwinds/observability_self-hosted < 2025.4

Timeline

Published Oct 21, 2025
Tracked Since Feb 18, 2026