CVE-2026-28317

CRITICAL

SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability

Title source: cna

Description

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation. This issue requires domain administrator access. The impact is lower in Windows deployments.

References (2)

Core 2

Core References

Vendor Advisory vendor-advisory

https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28317

Release Notes release-notes

https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_2026-3_release_notes.htm

Scores

CVSS v3 9.1

EPSS 0.0034

EPSS Percentile 27.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-639

Status published

Products (2)

solarwinds/serv-u < 2026.3

SolarWinds/Serv-U 15.5.4 HF1 and below

Published Jul 21, 2026

Tracked Since Jul 21, 2026