CVE-2025-26397

7.8 highEPSS 0.3%

High (7.8) in solarwinds observability self-hosted. EPSS 0.3% chance of exploitation in the next 30 days.

SolarWinds Observability Self-Hosted is susceptible to Deserialization of Untrusted Data Local Privilege Escalation vulnerability. An attacker with low privileges can escalate privileges to run malicious files copied to a permission-protected folder. This vulnerability requires authentication from a low-level account and local access to the host server.

Severity

CVSS 3.1

7.8 high

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 28% of CVEs (scores of 2026-10-31)
CWE: CWE-502
Published: 2025-07-24
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

solarwinds:observability_self-hosted

References

https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2025-2-1_release_notes.htm
https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-26397

Check your stack JSON