EN PT-BR
← Voltar ao feed
medium

CERT-FR flags multiple vulnerabilities in SolarWinds Observability Self-Hosted and Patch Manager before 2026.4

1 fonte(s) · 1 atualização(ões) · publicado 21/10/2026 21:00 · coletado há 6 dias

CERT-FR published advisory CERTFR-2026-AVI-1364 on multiple vulnerabilities in SolarWinds products: Observability Self-Hosted and Patch Manager, both in versions earlier than 2026.4. According to the advisory, the flaws allow an attacker to achieve privilege escalation, server-side request forgery (SSRF) and indirect remote code injection (XSS). The advisory lists impacts on data integrity and confidentiality. SolarWinds published its security advisories on 20 October 2026. The advisory does not report active exploitation and gives no CVSS scores.

Entenda a falha

A vulnerabilidade

CERT-FR advisory CERTFR-2026-AVI-1364 covers multiple flaws in SolarWinds Observability Self-Hosted and SolarWinds Patch Manager, all versions before 2026.4. The CVEs are CVE-2026-28308, CVE-2026-28324, CVE-2026-28328, CVE-2026-28329, CVE-2026-28330 and CVE-2026-28331. The advisory says an attacker can achieve privilege escalation, server-side request forgery (SSRF) and indirect remote code injection (XSS), with impact on data integrity and confidentiality. It does not map each CVE to a product or flaw class, and gives no CVSS scores, so severity ranking is not possible. It also does not state the access, authentication or user interaction required. The fix is version 2026.4 or later. No active exploitation is reported.

Como funciona

The articles do not describe how the vulnerable processes work. They only name the classes of impact: privilege escalation, SSRF, where the server could be made to issue requests, and XSS, where content is injected indirectly. They do not say which component, endpoint or input is involved in any CVE. Details are in the SolarWinds advisories, which were not included in the material.

Por que é vulnerável

The articles do not state the root causes. They only give the vulnerability classes (privilege escalation, SSRF, XSS) and do not explain why the flaws went unnoticed or what the fix changes in the code. The remediation is to upgrade to 2026.4 or later.

Como foi descoberta

The articles do not say who found the flaws or how. SolarWinds published security advisories dated 20 October 2026 for CVE-2026-28328 through CVE-2026-28331, and CERT-FR published its advisory on 22 October 2026, directing readers to the vendor bulletins for patches. No advisory is cited for CVE-2026-28308 and CVE-2026-28324. No active exploitation is reported.

Explicação gerada por IA a partir da matéria e dos artigos, em 26/10/2026 14:19.

Detalhes técnicos

  • Affected: SolarWinds Observability Self-Hosted before 2026.4 and SolarWinds Patch Manager before 2026.4.
  • Vulnerability classes: privilege escalation, SSRF, XSS.
  • CVEs referenced: CVE-2026-28308, CVE-2026-28324, CVE-2026-28328, CVE-2026-28329, CVE-2026-28330, CVE-2026-28331. The advisory does not map each CVE to a specific product or flaw class.
  • SolarWinds advisories are cited for CVE-2026-28328 to CVE-2026-28331, dated 20 October 2026.

Remediação

  • Upgrade Observability Self-Hosted and Patch Manager to version 2026.4 or later.
  • Consult the SolarWinds security advisories for the patches, as CERT-FR directs.

Linha do tempo

  1. cert.cyber.gouv.fr ↗ · pub. 21/10/2026 21:00 · coletado 26/10 14:01 primeiro registro

    CERT-FR flags multiple vulnerabilities in SolarWinds Observability Self-Hosted and Patch Manager before 2026.4

    ler a análise desta fonte

    CERT-FR published advisory CERTFR-2026-AVI-1364 on multiple vulnerabilities in SolarWinds products: Observability Self-Hosted and Patch Manager, both in versions earlier than 2026.4. According to the advisory, the flaws allow an attacker to achieve privilege escalation, server-side request forgery (SSRF) and indirect remote code injection (XSS). The advisory lists impacts on data integrity and confidentiality. SolarWinds published its security advisories on 20 October 2026. The advisory does not report active exploitation and gives no CVSS scores.

    Technical Details

    • Affected: SolarWinds Observability Self-Hosted before 2026.4 and SolarWinds Patch Manager before 2026.4.
    • Vulnerability classes: privilege escalation, SSRF, XSS.
    • CVEs referenced: CVE-2026-28308, CVE-2026-28324, CVE-2026-28328, CVE-2026-28329, CVE-2026-28330, CVE-2026-28331. The advisory does not map each CVE to a specific product or flaw class.
    • SolarWinds advisories are cited for CVE-2026-28328 to CVE-2026-28331, dated 20 October 2026.

    Remediation

    • Upgrade Observability Self-Hosted and Patch Manager to version 2026.4 or later.
    • Consult the SolarWinds security advisories for the patches, as CERT-FR directs.