← Vulnerability feed

Vulnerability record · CVE-2025-26397 · published 24 July 2025

CVE-2025-26397: Solarwinds observability self-hosted deserialization of untrusted data vulnerability

Solarwinds · Observability Self Hosted

SolarWinds Observability Self-Hosted is susceptible to Deserialization of Untrusted Data Local Privilege Escalation vulnerability. An attacker with low privileges can escalate privileges to run malicious files copied to a permission-protected folder. This vulnerability requires authentication from a low-level account and local access to the host server.

7.8 CVSS 3.1 High EPSS 0.30% · top 80.1% CWE-502 · Deserialization of untrusted data
7.8CVSS 3.1 base score
0.30%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

SolarWinds Observability Self-Hosted is susceptible to Deserialization of Untrusted Data Local Privilege Escalation vulnerability. An attacker with low privileges can escalate privileges to run malicious files copied to a permission-protected folder. This vulnerability requires authentication from a low-level account and local access to the host server.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://documentation.solarwinds.com/en/success_center/orionplatform/content/release_notes/solarwinds_platform_2025-2-1_ Release Notes
https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-26397 PatchVendor Advisory

Track CVE-2025-26397 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.7CVE-2026-28297Solarwinds observability self-hosted cross-site scripting vulnerabilitySolarWinds Observability Self-Hosted was found to be affected by a stored cross-site scripting vulnerability, which when exploited, can lead to unint…EPSS 0.45%8.1CVE-2026-28298Solarwinds observability self-hosted cross-site scripting vulnerabilitySolarWinds Observability Self-Hosted was found to be affected by a stored cross-site scripting vulnerability, which when exploited, can lead to unint…EPSS 0.42%5.4CVE-2025-26391Solarwinds observability self-hosted cross-site scripting vulnerabilitySolarWinds Observability Self-Hosted XSS Vulnerability. The SolarWinds Platform was susceptible to a XSS vulnerability that affects user-created URL …EPSS 0.28%4.8CVE-2025-26394Solarwinds observability self-hosted open redirect vulnerabilitySolarWinds Observability Self-Hosted is susceptible to an open redirection vulnerability. The URL is not properly sanitized, and an attacker could ma…EPSS 0.19%4.6CVE-2025-26392Solarwinds observability self-hosted sql injection vulnerabilitySolarWinds Observability Self-Hosted is susceptible to SQL injection vulnerability that may display sensitive data using a low-level account. This vu…EPSS 0.24%4.4CVE-2025-40545Solarwinds observability self-hosted open redirect vulnerabilitySolarWinds Observability Self-Hosted is susceptible to an open redirection vulnerability. The URL is not properly sanitized, and an attacker could ma…EPSS 0.23%4.3CVE-2025-26395Solarwinds observability self-hosted cross-site scripting vulnerabilitySolarWinds Observability Self-Hosted was susceptible to a cross-site scripting (XSS) vulnerability due to an unsanitized field in the URL. The attack…EPSS 0.21%9.8CVE-2021-23758Ajax.NET Professional ajaxpro.2 untrusted deserialization RCEAll versions of the ajaxpro.2 package (Ajax.NET Professional) deserialize untrusted data and permit deserialization of arbitrary .NET classes. That l…KEVEPSS 83%analysed

Source: NIST National Vulnerability Database (record CVE-2025-26397), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.