CVE-2026-28308

CRITICAL

SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability

Title source: cna
STIX 2.1

Description

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution. Domain administrator access is required. The impact is lower in Windows deployments.

References (2)

Core 2

Scores

CVSS v3 9.1
EPSS 0.0055
EPSS Percentile 42.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-639
Status published
Products (2)
solarwinds/serv-u < 2026.3
SolarWinds/Serv-U 15.5.4 HF1 and below
Published Jul 21, 2026
Tracked Since Jul 21, 2026