SolarWinds Observability Self‑Hosted contains a stored cross‑site scripting flaw that allows an attacker to inject malicious scripts into a page that is subsequently rendered to other users. The vulnerability is categorized as CWE‑79 and can lead to unintended script execution, which may enable attackers to hijack user sessions, deface content, or perform actions on behalf of authenticated users. The impact is confined to a compromised browser context but can be leveraged for broader credential theft or phishing attacks.

The affected product is SolarWinds Observability Self‑Hosted. No specific version numbers are identified in the available data, so administrators should verify whether their deployment includes the vulnerable component and consult the vendor for the latest update.

The CVSS base score for this issue is 5.9, indicating medium severity. Exploitability data from EPSS is not provided, and the vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited. The attack vector is inferred to be an authenticated user or attacker who can supply the malicious payload to a location that is stored and later rendered to other users, such as a comment or description field. Without an existing patch, the risk remains medium to high for any environment that allows unauthenticated or low‑privilege users to input content that is displayed to higher‑privileged users.