CVE-2025-40545
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
SolarWinds Observability Self-Hosted is susceptible to an open redirection vulnerability. The URL is not properly sanitized, and an attacker could manipulate the string to redirect a user to a malicious site. Attack complexity is high and authentication is required.
Risk Assessment
An authenticated attacker can redirect a user to a malicious site, potentially leading to phishing or credential theft.
Recommendation
Update SolarWinds Observability Self-Hosted to a patched version and educate users about verifying URLs.
Other vulnerabilities in SolarWinds Observability Self-Hosted
See all- CVE-2026-28330Medium
SolarWinds Observability Self-Hosted is affected by a stored Cross-Site Scripting (XSS) vulnerability that allows authenticated attackers to inject malicious content or JavaScript, which is displayed or executed in the browsers of other authenticated users who access the affected pages. This may lead to session hijacking.
- CVE-2026-28329Medium
SolarWinds Observability Self-Hosted was found to be affected by a Server-Side Request Forgery (SSRF) vulnerability that allows authenticated attackers to cause the application server to send requests to attacker-controlled or internal destinations.
- CVE-2026-28328High
SolarWinds Observability Self-Hosted was found to be affected by a broken authorization schema that can allow low-privileged users to access and modify information beyond their assigned permissions.
- CVE-2026-28324Critical
SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability due to insufficient integrity checks. Installations configured in a non-default and non-secure configuration are affected.
- CVE-2026-28325High
SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability stemming from deserialization of untrusted data when the application is configured to use a specific communication mode.
- CVE-2025-26391Medium
SolarWinds Observability Self-Hosted contains an XSS vulnerability in the SolarWinds Platform affecting user-created URL fields. Exploitation requires authentication from a low-level account.
- CVE-2025-26392Medium
SolarWinds Observability Self-Hosted is susceptible to SQL injection that may display sensitive data using a low-level account. Requires authentication from a low-privilege account.
Original NVD description (English source)
SolarWinds Observability Self-Hosted is susceptible to an open redirection vulnerability. The URL is not properly sanitized, and an attacker could manipulate the string to redirect a user to a malicious site. The attack complexity is high, and authentication is required.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS