SolarWinds Observability Self-Hosted Deserialization of Untrusted Data Local Privilege Escalation Vulnerability

A local privilege escalation vulnerability has been identified in SolarWinds Observability Self-Hosted versions through 2025.2. This vulnerability arises from the deserialization of untrusted data, allowing an attacker with low privileges to escalate rights and execute malicious files placed in a permission-protected directory. Exploitation requires authentication from a low-level account and local access to the host server.

Impact

Successful exploitation of this vulnerability allows for local privilege escalation, enabling an attacker to execute malicious files with elevated rights.

Remediation

Users can upgrade to SolarWinds Observability Self-Hosted version 2025.2.1 to address this vulnerability.