Observability

Why SolarWinds Observability Self-Hosted and SolarWinds Database Performance Analyzer are not affected by CVE-2026-49844

This article explains why SolarWinds Observability Self-Hosted and SolarWinds Database Performance Analyzer are not affected by CVE-2026-49844.

First published date

7/29/2026 8:55 PM

Last published date

7/29/2026 8:55 PM

Overview

In 2026, the National Institute of Standards and Technology (NIST) published a security bulletin about NVD - CVE-2026-49844.

Product section

Hybrid Cloud Observability

Cause

CVE-2026-49844 is an input validation vulnerability in Apache Log4j API that can produce malformed JSON logs when a MapMessage contains attacker-controlled NaN, Infinity, or -Infinity values. The issue is exploitable only if the application uses JsonTemplateLayout (or another layout relying on MapMessage.asJson()) and logs an attacker-controlled MapMessage. Successful exploitation can disrupt log ingestion and parsing but does not lead to remote code execution.

Resolution

Although SolarWinds Observability Self-Hosted includes a version of Log4j affected by this vulnerability, the product is not impacted because it does not use JsonTemplateLayout or the vulnerable code path.

SolarWinds Database Performance Analyzer is unaffected by this vulnerability because it does not use JsonTemplateLayout & MapMessage.asJson(), the vulnerable components.

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment. You elect to use third-party content at your own risk, and you will be solely responsible for the incorporation of the same if any.