SolarWinds security advisory (AV25-462)

Serial number: AV25-462
Date: July 29, 2025

On July 24 and 29, 2025, SolarWinds published security advisories to address vulnerabilities in the following products:

• SolarWinds Observability Self-Hosted – version SWOSH 2025.2 and prior
• SolarWinds Web Help Desk – version 12.8.6 and prior

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• SolarWinds Observability Self-Hosted Deserialization of Untrusted Data Local Privilege Escalation Vulnerability (CVE-2025-26397)
• SolarWinds Web Help Desk XML External Entity Injection (XXE) Vulnerability (CVE-2025-26400)
• SolarWinds Security Vulnerabilities