Why SolarWinds Database Performance Analyzer (DPA) is at low risk for CVE-2026-58058

In 2026, the National Institute of Standards and Technology (NIST) published a security bulletin about CVE-2026-58058.

NVD-CVE-2026-58058

Mitigation

Users have the option to manually upgrade Nmap and Npcap independently using these steps.

1. Stop the DPA service.
2. Manually uninstall Nmap 7.98 from DPA installed location.
3. Install new Nmap 7.991 at one standard location like (C:\Program Files or C:\Program Files (x86))
4. In the standard installation wizard of Nmap, include the installation of Npcap.
5. Start the DPA service.

CVE-2026-58058 is a vulnerability with Nmap through 7.99 where it does not keep the IPv6 extension-header walk within the captured packet in ipv6_get_data_primitive (libnetutil/netutil.cc), so the pointer advances past the buffer and the remaining-length computation underflows to a large value. A scanned target or on-path attacker returning a crafted IPv6 response with a truncated extension header can trigger out-of-bounds reads and a crash during raw IPv6 scans.

SolarWinds Database Performance Analyzer (DPA) is at low risk for CVE-2026-58058.

This vulnerability requires all the following conditions:

• The customer has configured IPv6-only targets/ranges for network discovery
• Nmap is running with sufficient privileges (admin) to perform raw packet capture
• A host on the scanned network or an on-path attacker sends back a maliciously truncated IPv6 packet during the scan window

DPA's discovery feature only scans customer-designated internal IP ranges; typically, corporate network segments used for database discovery. The application does not scan or receive traffic from the public internet, the scan is admin-initiated and not exposed via a public API.

Even if triggered, the impact is limited to a crash of the nmap.exe subprocess and will not allow remote code execution. DPA's discovery job would simply fail for that scan and could be retried; no state of the DPA application server itself is compromised.

IPv4 scans are not affected, since the flaw is specific to `ipv6_get_data_primitive()`, which only processes IPv6 extension headers.”

While the component’s presence is flagged by dependency scanning tools, our analysis shows there is no associated security risk. We are tracking this dependency and plan to remove or upgrade it in a future release to fully eliminate the finding.