CVE-2025-26394

SolarWinds Observability Self-Hosted is susceptible to an open redirection vulnerability. The URL is not properly sanitized, and an attacker could manipulate the string to redirect a user to a malicious site. The attack complexity is high, and authentication is required.

• CWE-601

• https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/hco_2025-2_release_notes.htmRelease Notes
• https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-26394Patch, Vendor Advisory

Published

Jun 10, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-26389A vulnerability has been identified in OZW672 (All versions …9.8
• CVE-2025-2639A vulnerability has been found in JIZHICMS up to 1.7.0 and c…5.3
• CVE-2025-26390A vulnerability has been identified in OZW672 (All versions …9.8
• CVE-2025-26391SolarWinds Observability Self-Hosted XSS Vulnerability. The …5.4
• CVE-2025-26392SolarWinds Observability Self-Hosted is susceptible to SQL i…4.6
• CVE-2025-26393SolarWinds Service Desk is affected by a broken access contr…5.4
• CVE-2025-26395SolarWinds Observability Self-Hosted was susceptible to a …4.3
• CVE-2025-26396The SolarWinds Dameware Mini Remote Control was determined t…7.8
• CVE-2025-26397SolarWinds Observability Self-Hosted is susceptible to Deser…7.8
• CVE-2025-26398SolarWinds Database Performance Analyzer was found to contai…6.4
• CVE-2025-26399SolarWinds Web Help Desk was found to be susceptible to an u…9.8
• CVE-2025-2640A vulnerability was found in PHPGurukul Doctor Appointment M…9.8