Database Management

Why Database Performance Analyzer is not affected by CVE-2026-34478

This article explains why Database Performance Analyzer (DPA) is not affected by CVE-2026-34478.

First published date

5/14/2026 5:57 PM

Last published date

5/14/2026 5:57 PM

Overview

In 2026, the National Institute of Standards and Technology (NIST) published a security bulletin about NVD - CVE-2026-34478.

Product section

Database Performance Analyzer

Cause

CVE-2026-34478 is a vulnerability in certain versions of Apache Log4j can allow attackers to manipulate log entries or weaken secure log transmission settings, potentially exposing systems that send logs over network-based syslog services.

Resolution

The CVE only affects users who directly configure Rfc5424Layout with stream-based (TCP/TLS) syslog services of Log4j configuration.

DPA uses standard Log4j layouts (e.g., PatternLayout) writing to file/console appenders, not RFC 5424 syslog over TCP/TLS, which are generally not affected.

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment. You elect to use third-party content at your own risk, and you will be solely responsible for the incorporation of the same if any.