CVE-2025-26398

6.4 mediumEPSS 0.2%

Medium (6.4) in solarwinds database performance analyzer. EPSS 0.2% chance of exploitation in the next 30 days.

SolarWinds Database Performance Analyzer was found to contain a hard-coded cryptographic key. If exploited, this vulnerability could lead to a machine-in-the-middle (MITM) attack against users. This vulnerability requires additional software not installed by default, local access to the server and administrator level privileges on the host.

Severity

CVSS 3.1

6.4 medium

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 8% of CVEs (scores of 2026-10-31)
CWE: CWE-798
Published: 2025-08-12
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

solarwinds:database_performance_analyzer

References

https://documentation.solarwinds.com/en/success_center/dpa/content/release_notes/dpa_2025-3_release_notes.htm
https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-26398

Check your stack JSON