The vulnerability is a stored Cross‑Site Scripting flaw that permits a logged‑in attacker to embed malicious scripts into the web interface. When another authenticated user views the impacted page, the injected code is rendered and executed within that user's browser session, potentially allowing the attacker to hijack the session, steal credentials, or perform actions on behalf of the victim.

SolarWinds Observability Self‑Hosted is the affected product. No specific version range is supplied; however, all installations deployed prior to the release of version 2026.4 are potentially vulnerable. The flaw is present in the web components that accept or store user‑supplied content.

The CVSS score of 4.6 indicates moderate severity. The absence of an EPSS score and of inclusion in the KEV catalog suggests limited evidence of exploitation, yet the attack requires user authentication, limiting its audience to legitimate users. Exploitation requires the attacker to log in, inject a payload, and wait for another user to encounter the malicious page. Given the moderate CVSS and that the impact is confined to authenticated users, the overall operational risk is medium, but organizations should not ignore it.