CVE-2025-26397: SolarWinds Observability Privilege Escalation

CVE-2025-26397 Overview

CVE-2025-26397 affects SolarWinds Observability Self-Hosted and stems from insecure deserialization of untrusted data [CWE-502]. An authenticated attacker with low privileges and local access to the host server can escalate privileges by placing malicious files in a permission-protected folder. The affected process then deserializes those files and executes them in a higher-privilege context. SolarWinds addressed the issue in a platform update tracked through the vendor's security advisory. The vulnerability carries a CVSS score of 7.8 and requires local access plus valid low-privilege credentials, which limits remote mass exploitation but remains relevant for insider threat and post-compromise scenarios.

Critical Impact
An authenticated local attacker can escalate to a higher-privileged account and execute arbitrary code on the SolarWinds Observability Self-Hosted server, compromising the confidentiality, integrity, and availability of monitored infrastructure.

Affected Products

SolarWinds Observability Self-Hosted (versions prior to the fix documented in the SolarWinds Platform 2025.2.1 release)
Deployments using the affected SolarWinds Platform component on Windows host servers
Self-hosted monitoring environments exposing local logon or interactive session access to low-privilege users

Discovery Timeline

2025-07-24 - CVE-2025-26397 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-26397

Vulnerability Analysis

The flaw is an insecure deserialization issue in SolarWinds Observability Self-Hosted. The affected component reads serialized objects from a filesystem location and reconstructs them without validating type, source, or integrity. When an attacker stages a crafted serialized payload in that location, the deserialization process triggers gadget chains that execute attacker-controlled code.

Because the deserialization runs under a privileged service account, code execution occurs in a context above the attacker's original session. This converts a low-privilege foothold into full control over the observability host. The attack requires low-privileged authentication and local access, so it typically follows an initial intrusion rather than acting as an initial access vector.

SolarWinds Observability Self-Hosted aggregates telemetry from many downstream systems, so compromise of the host can expose credentials, agent configurations, and monitoring data across the environment.

Root Cause

The root cause is deserialization of untrusted data [CWE-502]. The application accepts serialized input from a location writable by a lower-privileged principal and passes it to a deserializer that instantiates arbitrary object graphs. Without an allow-list of expected types or signature verification on the serialized blob, gadget chains available in the loaded assemblies can be abused to execute code during object reconstruction.

Attack Vector

Exploitation requires local access to the host and valid low-privilege credentials. The attacker copies a malicious file into a permission-protected folder that the vulnerable service reads. When the service deserializes the file, the crafted payload executes as the service identity, granting privilege escalation on the host. No user interaction is required, and the attack complexity is low.

No public proof-of-concept, exploit database entry, or CISA KEV listing exists for CVE-2025-26397 at the time of publication. Full technical detail is limited to the SolarWinds Security Advisory CVE-2025-26397.

Detection Methods for CVE-2025-26397

Indicators of Compromise

Unexpected file writes by a low-privileged user into SolarWinds Platform installation directories or working folders used by the Observability Self-Hosted service.
New child processes spawned by SolarWinds service accounts that launch cmd.exe, powershell.exe, or other interpreters shortly after file drops.
Outbound network connections initiated by SolarWinds service processes to non-SolarWinds destinations.
Creation of new local accounts, scheduled tasks, or services on the SolarWinds host following interactive logon by a low-privileged user.

Detection Strategies

Monitor filesystem write events targeting SolarWinds Observability directories and alert on writes performed by non-service, non-administrator principals.
Correlate low-privilege interactive or remote logons on SolarWinds hosts with subsequent process creation events under SolarWinds service accounts.
Track loading of .NET serialization gadgets and reflective code execution within SolarWinds service process trees.

Monitoring Recommendations

Forward Windows Security, Sysmon, and SolarWinds application logs to a centralized platform such as Singularity Data Lake for correlation and retention.
Baseline expected process ancestry for SolarWinds services and alert on deviations, especially interpreter or LOLBin execution.
Review authentication logs weekly for low-privilege accounts with local logon rights on monitoring servers and remove access where not required.

How to Mitigate CVE-2025-26397

Immediate Actions Required

Upgrade SolarWinds Observability Self-Hosted to the fixed release documented in the SolarWinds Platform 2025.2.1 Release Notes.
Restrict interactive and remote logon rights on the SolarWinds host to administrators and required service accounts only.
Audit membership of any low-privilege groups that can authenticate to the Observability Self-Hosted server and remove unnecessary accounts.
Review recent filesystem and process activity on the host for signs of prior exploitation before patching.

Patch Information

SolarWinds released a fix through the SolarWinds Platform update tracked in the vendor advisory. Administrators should apply the update referenced in the SolarWinds Security Advisory CVE-2025-26397 and validate the deployed version against the release notes after the upgrade.

Workarounds

Tighten NTFS permissions on directories consumed by the Observability service so that only the service identity and administrators can write to them.
Remove local logon rights from low-privilege accounts on the SolarWinds host until the patch is applied.
Segment the SolarWinds Observability host on a management VLAN and restrict inbound access to trusted administrator workstations.
Enable application allow-listing on the SolarWinds host to block execution of unapproved binaries dropped by non-administrative users.

bash

# Example: restrict write access on a SolarWinds working directory (PowerShell)
$path = 'C:\ProgramData\SolarWinds\Observability'
icacls $path /inheritance:r
icacls $path /grant:r 'SYSTEM:(OI)(CI)F' 'Administrators:(OI)(CI)F' 'NT SERVICE\SolarWindsObservability:(OI)(CI)M'
icacls $path /remove 'Users' 'Authenticated Users'