CVE-2026-28331 SolarWinds Patch Manager Sensitive Information Exposure Vulnerability

MediumCVSS 4.4 EPSS 0.19%

Published: 2026-10-20 19:11
Updated: 2026-10-20 22:59
Exploit status: No public exploit known

Sign in for asset impact Search another CVE

Description

SolarWinds Patch Manager exposes sensitive information accessible to local users, which could be used to gain elevated privileges.

Affected products

Product	Affected versions	Fixed in
solarwinds Patch Manager	= 2026.2 and all previous versions	No fix listed

References

documentation.solarwinds.com release-notes
www.solarwinds.com vendor-advisory

CVSS v3.1

4.4 Medium

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Attack Vector: Local
Attack Complexity: Low
Privileges Required: High
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None

All scores (2)

v3.1 4.4 · solarwinds
v3.1 4.4 · psirt@solarwinds.com

Weakness & likelihood

EPSS (exploitation probability, 30 days): 0.19% (percentile 9.0)
CWE: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.