SolarWinds Observability Self-Hosted Deserialization of Untrusted Data Local Privilege Escalation Vulnerability 

Summary

SolarWinds Observability Self-Hosted is susceptible to Deserialization of Untrusted Data Local Privilege Escalation vulnerability. An attacker with low privileges can escalate privileges to run malicious files copied to a permission-protected folder. This vulnerability requires authentication from a low-level account and local access to the host server.

Affected Products

SWOSH 2025.2 and prior versions

Fixed Software Release

SWOSH 2025.2.1

Acknowledgments

ccc working with the Trend Micro Zero Day Initiative