{"id":"CVE-2025-26398","aliases":["EUVD-2025-24229","GHSA-wmch-r6fm-gmwh"],"status":"published","title":"SolarWinds Database Performance Analyzer Hard-coded Cryptographic Key Vulnerability","description":"SolarWinds Database Performance Analyzer was found to contain a hard-coded cryptographic key. If exploited, this vulnerability could lead to a machine-in-the-middle (MITM) attack against users. This vulnerability requires additional software not installed by default, local access to the server and administrator level privileges on the host.","severity":{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.002,"percentile":0.10032,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-798"],"published":"2025-08-12T08:10:54Z","modified":"2026-06-17T09:01:42Z","products":[{"vendor":"solarwinds","product":"database performance analyzer"},{"vendor":"solarwinds","product":"database_performance_analyzer"}],"references":[{"url":"https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-26398","tags":["Patch","Vendor Advisory"]},{"url":"https://documentation.solarwinds.com/en/success_center/dpa/content/release_notes/dpa_2025-3_release_notes.htm","tags":["Release Notes","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-26398"},{"url":"https://github.com/advisories/GHSA-wmch-r6fm-gmwh"}],"sources":{"cve":[{"id":"CVE-2025-26398","title":"SolarWinds Database Performance Analyzer Hard-coded Cryptographic Key Vulnerability","description":"SolarWinds Database Performance Analyzer was found to contain a hard-coded cryptographic key. If exploited, this vulnerability could lead to a machine-in-the-middle (MITM) attack against users. This vulnerability requires additional software not installed by default, local access to the server and administrator level privileges on the host.","status":"published","published":"2025-08-12T08:10:54.116Z","modified":"2026-02-26T17:49:42.688Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-798"],"updated_at":"2026-11-02T14:32:27.932735Z"}],"euvd":[{"id":"EUVD-2025-24229","description":"SolarWinds Database Performance Analyzer was found to contain a hard-coded cryptographic key. If exploited, this vulnerability could lead to a machine-in-the-middle (MITM) attack against users. This vulnerability requires additional software not installed by default, local access to the server and administrator level privileges on the host.","status":"published","published":"2025-08-12T08:10:54Z","modified":"2026-02-26T17:49:42Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T19:48:20.263706Z"}],"ghsa":[{"id":"GHSA-wmch-r6fm-gmwh","title":"SolarWinds Database Performance Analyzer was found to contain a hard-coded cryptographic key. If...","description":"SolarWinds Database Performance Analyzer was found to contain a hard-coded cryptographic key. If exploited, this vulnerability could lead to a machine-in-the-middle (MITM) attack against users. This vulnerability requires additional software not installed by default, local access to the server and administrator level privileges on the host.","status":"published","published":"2025-08-12T09:30:31Z","modified":"2025-08-12T09:30:35Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"cwes":["CWE-798"],"updated_at":"2026-11-02T15:03:14.349614Z"}],"nvd":[{"id":"CVE-2025-26398","description":"SolarWinds Database Performance Analyzer was found to contain a hard-coded cryptographic key. If exploited, this vulnerability could lead to a machine-in-the-middle (MITM) attack against users. This vulnerability requires additional software not installed by default, local access to the server and administrator level privileges on the host.","status":"published","published":"2025-08-12T08:15:26.193Z","modified":"2026-06-17T09:01:42.287Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-798"],"updated_at":"2026-11-02T14:11:22.953396Z"}]}}