CVE-2025-26395
📋 TL;DR
SolarWinds Observability Self-Hosted has a cross-site scripting (XSS) vulnerability in an unsanitized URL field. This allows authenticated administrators to inject malicious scripts that could compromise other users' sessions or data. Only administrators with access to the vulnerable interface are affected.
💻 Affected Systems
- SolarWinds Observability Self-Hosted
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An authenticated malicious administrator could steal session cookies, perform actions as other users, or deploy malware to other administrators' browsers.
Likely Case
Limited impact due to requiring administrator authentication and user interaction; most likely used for session hijacking or credential theft among administrators.
If Mitigated
With proper access controls and administrator vetting, risk is minimal as exploitation requires privileged credentials and user interaction.
🎯 Exploit Status
Exploitation requires administrator credentials and social engineering to trick users into clicking malicious links.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2025.2
Vendor Advisory: https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-26395
Restart Required: Yes
Instructions:
1. Download SolarWinds Observability Self-Hosted version 2025.2 from SolarWinds customer portal. 2. Follow standard upgrade procedures documented in SolarWinds documentation. 3. Restart services after upgrade completion.
🔧 Temporary Workarounds
Input Validation Enhancement
allImplement additional input validation for URL parameters at the application layer
Not applicable - requires code changes
Content Security Policy
allImplement strict Content Security Policy headers to mitigate XSS impact
Add 'Content-Security-Policy: default-src 'self'' to web server configuration
🧯 If You Can't Patch
- Restrict administrator account access to trusted personnel only
- Implement web application firewall with XSS protection rules
🔍 How to Verify
Check if Vulnerable:
Check current version in SolarWinds Observability web interface under Help > AboutCheck Version:
Not applicable - check via web interfaceVerify Fix Applied:
Verify version shows 2025.2 or later after upgrade📡 Detection & Monitoring
Log Indicators:
- Unusual administrator activity patterns
- Multiple failed login attempts followed by successful administrator login
Network Indicators:
- Suspicious JavaScript payloads in URL parameters
- Unusual outbound connections from administrator workstations
SIEM Query:
source="solarwinds" AND (url="*<script>*" OR url="*javascript:*")