CVE-2025-26392: SolarWinds Observability Self-Hosted

Medium severity, CVSS 4.6. EPSS: 0.2% chance of exploitation in the next 30 days.

SolarWinds Observability Self-Hosted is susceptible to SQL injection vulnerability that may display sensitive data using a low-level account. This vulnerability requires authentication from a low-privilege account.

Affected products

• SolarWinds Observability Self-Hosted: before 2025.4 (fixed in 2025.4)

Published 2025-10-21. Last modified 2026-10-08.