CVE-2026-28322: SolarWinds Database Performance Analyzer Stored XSS Vulnerability

Technical summary

CVE-2026-28322 is a stored XSS vulnerability in SolarWinds Database Performance Analyzer stemming from improper input validation (CWE-20). The vulnerability permits authenticated attackers with high privileges to inject JavaScript that persists in the application's database. When a user with sufficient permissions accesses the affected functionality, the stored script executes in their browser context without sanitization or content security policy protections. The CVSS 3.1 score of 5.6 (Medium) reflects the attack vector (adjacent network access), high complexity, requirement for high privileges, user interaction, and limited impact scope—confidentiality and integrity are compromised, but availability is unaffected.

Business impact

A successful exploit enables attackers to steal session tokens, modify data displays, redirect users to malicious sites, or perform unauthorized actions on behalf of authenticated users. In managed database environments where DPA is used for performance monitoring and administration, this could result in unauthorized configuration changes, data exfiltration, or lateral movement. The risk is particularly acute if the attacker is an insider or has compromised a high-privilege account; external attackers face higher barriers due to access and authentication requirements.

Affected systems

SolarWinds Database Performance Analyzer versions prior to the patched release are affected. Organizations running DPA in production environments should verify their specific version against the SolarWinds security advisory to confirm exposure. The vulnerability does not appear on the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting active exploitation in the wild has not yet been documented at time of publication.

Exploitability

Exploitation requires an attacker to be on the same network segment (adjacent network access), possess authenticated credentials with high-privilege roles, craft a malicious payload, and trick a user into viewing the stored payload. The combination of high-complexity conditions, privilege requirements, and necessary user interaction substantially reduces exploitability compared to unauthenticated remote vulnerabilities. However, in multi-tenant or shared environments where trust levels are lower, the practical barrier to exploitation decreases.

Remediation

Immediately apply the security patch released by SolarWinds for Database Performance Analyzer. Verify patch availability and compatibility with your deployed version through the official SolarWinds security advisory. As interim mitigation, restrict network access to DPA management interfaces, enforce principle of least privilege for administrative accounts, and monitor for suspicious script injection attempts in database logs or network traffic.

Patch guidance

Contact SolarWinds support or review the security advisory published alongside this CVE to identify the patched version for your DPA deployment. Testing patches in a non-production environment is recommended before production rollout, particularly in critical database monitoring scenarios. Prioritize patching systems used for sensitive database management or those accessible to untrusted internal users.

Detection guidance

Monitor DPA application logs for unusual input patterns, HTML tags, or JavaScript keywords in stored parameters. Review user access logs for high-privilege account activity, especially modifications to configuration or reporting areas. Deploy Web Application Firewall (WAF) rules to detect common XSS payloads in requests to DPA. Monitor browser-based alerts for Content Security Policy violations if CSP is implemented. Check for unauthorized JavaScript execution in user sessions or unexpected network requests from DPA interfaces.

Why prioritize this

While the CVSS score is Medium (5.6), the vulnerability merits near-term patching because it affects a trusted administrative tool used for database management. Compromised credentials from an XSS exploit could enable lateral movement to backend database systems. The absence from the KEV catalog suggests a window before widespread exploitation; proactive patching prevents future weaponization. Organizations managing critical databases should prioritize this above lower-impact medium-severity vulnerabilities.

Risk score, explained

The CVSS 3.1 score of 5.6 reflects the layered authentication and user interaction requirements that reduce overall risk. Adjacent network access limits remote exploitability, and high-privilege role requirements narrow the attacker pool. However, confidentiality and integrity impacts are rated high, meaning successful exploitation could yield sensitive data or enable unauthorized modifications. The score appropriately balances the technical severity of XSS against realistic attack prerequisites; security teams should not equate a Medium rating with low business risk in administrative tools.

Frequently asked questions