Is CVE-2026-28301 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-28301 being exploited in the wild.

How severe is CVE-2026-28301?

Medium severity, with a CVSS score of 4.8, published 9 June 2026.

Which products and versions are affected?

SolarWinds Observability Self-Hosted 2026.1.1 and below.

Is there a fix for CVE-2026-28301?

A patch was published on 2026-06-09: Fixed in version 2026.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-28301 attacked?

It is attacked from the adjacent network, in a network appliance.

Am I affected by CVE-2026-28301?

Check whether you run SolarWinds Observability Self-Hosted at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-28301: SolarWinds Observability Self-Hosted open redirect

CVE-2026-28301 · Severity: medium · CVSS 4.8 · Published 2026-06-09

SolarWinds Observability Self-Hosted is a platform used by IT teams to monitor and manage their infrastructure and applications. A security flaw in this software could allow an attacker to trick users into visiting malicious websites by providing a specially crafted link. This could be used in phishing attempts to steal user credentials or deliver malware, potentially compromising the security of the organization's monitoring environment.

Technologies: SolarWinds Observability Self-Hosted. Vendors: SolarWinds.

Quick answers

Is CVE-2026-28301 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-28301 being exploited in the wild.
How severe is CVE-2026-28301?: Medium severity, with a CVSS score of 4.8, published 9 June 2026.
Which products and versions are affected?: SolarWinds Observability Self-Hosted 2026.1.1 and below.
Is there a fix for CVE-2026-28301?: A patch was published on 2026-06-09: Fixed in version 2026.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-28301 attacked?: It is attacked from the adjacent network, in a network appliance.
Am I affected by CVE-2026-28301?: Check whether you run SolarWinds Observability Self-Hosted at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An open redirect vulnerability (CWE-601) exists in SolarWinds Observability Self-Hosted (formerly Hybrid Cloud Observability) versions 2026.1.1 and below. The flaw allows an attacker to craft a URL that, when processed by the application, redirects the victim to an arbitrary external domain. Exploitation requires the attacker to have low-level privileges and access to the adjacent network, with high complexity involved in the attack. This vulnerability can be leveraged to conduct sophisticated phishing attacks or bypass security filters that trust the SolarWinds domain. The issue is resolved in version 2026.2.

Affected products

SolarWinds Observability Self-Hosted 2026.1.1 and below

Timeline

2026-06-09: disclosed
2026-06-09: advisory
2026-06-09: patched: Fixed in version 2026.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.