This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] SolarWinds fixes 2 vulnerabilities
SolarWinds fixes 2 vulnerabilities in the Observability Self-Hosted and Web Help Desk products [1][2]. Products and their fixes: SolarWinds Observability Self-Hosted - 2025.2.1 [1] SolarWinds Web Help Desk - 12.8.7 [2]
An authenticated local attacker with low privileges, due to deserialization of untrusted data, is able to escalate privileges and run malicious files from a protected directory [1].
The vulnerability is present in product:
- SolarWinds Observability Self-Hosted; <=2025.2
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2025-26397 at cve.org, NVD
- CWE-502: Deserialization of Untrusted Data at cwe.mitre.org
The vulnerability was publicly disclosed 24. 7. 2025.
An authenticated remote attacker, due to an XML External Entity Injection (XXE) vulnerability, is able to obtain sensitive information. If the attacker has access to the local server and can modify configuration files, no login is required [2].
The vulnerability is present in product:
- SolarWinds Web Help Desk; <=12.8.6
CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
More information:
- CVE-2025-26400 at cve.org, NVD
- CWE-611: Improper Restriction of XML External Entity Reference at cwe.mitre.org
The vulnerability was publicly disclosed 29. 7. 2025.
Links
By CESNET, z.s.p.o. Michaela Jarošová on 5. 8. 2025.