SolarWinds Observability Self‑Hosted contains a stored cross‑site scripting flaw that allows attackers to embed malicious scripts in data displayed to users. When such payloads are injected, they execute in the browsers of any user who views the affected content, enabling session hijacking, data theft, or delivery of additional malware.

The vulnerability applies to all variants of SolarWinds Observability Self‑Hosted until an update is applied.

The flaw is considered of moderate severity. Exploration analyses suggest a low probability of active exploitation. The vulnerability is not catalogued as a known exploited vulnerability. Attackers must have the privilege to inject data into the system; the injected script runs when affected data is rendered in a victim’s browser.