Database Management

Why SolarWinds Database Performance Analyzer (DPA) is not affected by multiple Nmap vulnerabilities

This article explains why SolarWinds Database Performance Analyzer (DPA) is not affected by the following Nmap vulnerabilities: <p>CVE-2025-13836</p> CVE-2025-13836 CVE-2025-11468 CVE-2026-4224 CVE-2026-6019 CVE-2026-3276 CVE-2025-13837 CVE-2026-1299 CVE-2026-4360 CVE-2025-13462 CVE-2026-1502 CVE-2026-3087 CVE-2026-11940 CVE-2026-0865 CVE-2026-4519 CVE-2025-8291 CVE-2026-7210 CVE-2026-3446 CVE-2025-12084 CVE-2026-12003 CVE-2025-12781 CVE-2026-6100 CVE-2026-3644 CVE-2026-2297 CVE-2025-6075 CVE-2026-9669 CVE-2026-11972 CVE-2025-15282 CVE-2026-4786 CVE-2026-3298 CVE-2026-0864 CVE-2026-8328 CVE-2026-7774 CVE-2026-0672 CVE-2026-72712

First published date

10/22/2026 1:11 PM

Last published date

10/22/2026 1:11 PM

Overview

In 2025 and 2026, the National Institute of Standards and Technology (NIST) published security bulletins about the following Nmap vulnerabilities:

Product section

Database Performance Analyzer

Cause

Please refer to the descriptions of the vulnerabilities detailed in the NVD links listed above.

Resolution

SolarWinds Database Performance Analyzer (DPA) is not affected by CVE-2025-13836, CVE-2025-11468, CVE-2026-4224, CVE-2026-6019, CVE-2026-3276, CVE-2025-13837, CVE-2026-1299, CVE-2026-4360, CVE-2025-13462, CVE-2026-1502, CVE-2026-3087, CVE-2026-11940, CVE-2026-0865, CVE-2026-4519, CVE-2025-8291, CVE-2026-7210, CVE-2026-3446, CVE-2025-12084, CVE-2026-12003, CVE-2025-12781, CVE-2026-6100, CVE-2026-3644, CVE-2026-2297, CVE-2025-6075, CVE-2026-9669, CVE-2026-11972, CVE-2025-15282, CVE-2026-4786, CVE-2026-3298, CVE-2026-0864, CVE-2026-8328, CVE-2026-7774, CVE-2026-0672, and CVE-2026-72712.

CVE-2025-13836, CVE-2025-11468, CVE-2026-4224, CVE-2026-6019, CVE-2026-3276, CVE-2025-13837, CVE-2026-1299, CVE-2026-4360, CVE-2025-13462, CVE-2026-1502, CVE-2026-3087, CVE-2026-11940, CVE-2026-0865, CVE-2026-4519, CVE-2025-8291, CVE-2026-7210, CVE-2026-3446, CVE-2025-12084, CVE-2026-12003, CVE-2025-12781, CVE-2026-6100, CVE-2026-3644, CVE-2026-2297, CVE-2025-6075, CVE-2026-9669, CVE-2026-11972, CVE-2025-15282, CVE-2026-4786, CVE-2026-3298, CVE-2026-0864, CVE-2026-8328, CVE-2026-7774, CVE-2026-0672:

Nmap detected path: Zenmap is the only component of Nmap's official distribution that bundles a frozen CPython runtime (via py2exe) and it's (ZENMAP & NCAT) explicitly excluded from installation. DPA invokes the Nmap utility via nmap4j for Database Discovery feature for CLI-only scanning (no --script/-sC/-A), therefore DPA never touches NSE/Zenmap/ndiff code paths even on the Nmap side.

Tomcat detected path: DPA uses standard HTTP/HTTPS tomcat connectors with JSSE and not relying on the Tomcat native APR/OpenSSL connector for TLS. OpenSSL/Python related vulnerabilities are not applicable to DPA's installation of Tomcat.

CVE-2026-72712: DPA's nmap4j invocation never passes --script/-sC/-A, so the NSE Lua engine path is never exercised.

While the component’s presence is flagged by dependency scanning tools, our analysis shows there is no associated security risk.

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment. You elect to use third-party content at your own risk, and you will be solely responsible for the incorporation of the same if any.