CVE-2026-28302

CRITICAL 9.1

SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability

CVSS Score

9.1

EPSS Score

0.5%

EPSS Percentile

42th

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation and remote code execution as root. This issue requires group administrator access. The impact is lower in Windows deployments.

CWE	CWE-639
Vendor	solarwinds
Product	serv-u
Published	Jul 21, 2026
Last Updated	Jul 22, 2026

Stay Ahead of the Next One

Get instant alerts for solarwinds serv-u

Be the first to know when new critical vulnerabilities affecting solarwinds serv-u are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

SolarWinds / Serv-U

15.5.4 HF1 and below

References

NVD ↗ CVE.org ↗ EPSS Data ↗

solarwinds.com: https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28302 documentation.solarwinds.com: https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_2026-3_release_notes.htm

Credits

Intigriti Bug Bounty Program