CVE-2025-26398

MEDIUM

5.6

Description

SolarWinds Database Performance Analyzer was found to contain a hard-coded cryptographic key. If exploited, this vulnerability could lead to a machine-in-the-middle (MITM) attack against users. This vulnerability requires additional software not installed by default, local access to the server and administrator level privileges on the host.

Details CVE

Score CVSS v3.15.6

SeveriteMEDIUM

Vecteur CVSSCVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N

Vecteur d'attaqueLOCAL

ComplexiteHIGH

Privileges requisHIGH

Interaction utilisateurREQUIRED

Publie8/12/2025

Derniere modification11/17/2025

Sourcenvd

Observations honeypot0

Produits affectes

solarwinds:database_performance_analyzer

Faiblesses (CWE)

CWE-798

References

https://documentation.solarwinds.com/en/success_center/dpa/content/release_notes/dpa_2025-3_release_notes.htm(psirt@solarwinds.com)

https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-26398(psirt@solarwinds.com)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.