CVE-2026-28305 PUBLISHED

SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability

Assigner: SolarWinds
Reserved: 26.02.2026 Published: 21.07.2026 Updated: 21.07.2026

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution as root. A domain account with admin privileges and read and write access to the home directory is required. The impact is lower in Windows deployments.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS Score: 9.1

Serv-U Linux

Attack Vector	Network	Scope	Changed
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	High	Integrity Impact	High
User Interaction	None	Availability Impact	High

Serv-U Linux

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
CVSS Score: 4.7

Serv-U Windows

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	Low
Privileges Required	High	Integrity Impact	Low
User Interaction	None	Availability Impact	Low

Serv-U Windows

CVSS 3.1

Product Status

Vendor	SolarWinds
Product	Serv-U
Versions	Default: unaffected Version 15.5.4 HF1 and below is affected

Solutions

SolarWinds recommends customers to upgrade to Serv-U version 2026.3 as soon as is practical.

Credits

Intigriti Bug Bounty Program finder

References

Problem Types

CWE-639 Authorization Bypass Through User-Controlled Key CWE

Impacts

CAPEC-233 Privilege Escalation