CVE-2025-26397: SolarWinds Observability Self-Hosted

High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days.

SolarWinds Observability Self-Hosted is susceptible to Deserialization of Untrusted Data Local Privilege Escalation vulnerability. An attacker with low privileges can escalate privileges to run malicious files copied to a permission-protected folder. This vulnerability requires authentication from a low-level account and local access to the host server.

Affected products

• SolarWinds Observability Self-Hosted: before 2025.2.1 (fixed in 2025.2.1)

Published 2025-07-24. Last modified 2026-06-17.