CVE-2026-28309 PUBLISHED

SolarWinds Serv-U Broken Access Control Vulnerability

Assigner: SolarWinds
Reserved: 26.02.2026 Published: 21.07.2026 Updated: 21.07.2026

SolarWinds Serv-U is affected by a broken access control vulnerability that allows a domain administrator to create system administrator accounts. The impact is lower in Windows deployments.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS Score: 9.1

Serv-U Linux

Attack Vector	Network	Scope	Changed
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	High	Integrity Impact	High
User Interaction	None	Availability Impact	High

Serv-U Linux

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
CVSS Score: 4.7

Serv-U Windows

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	Low
Privileges Required	High	Integrity Impact	Low
User Interaction	None	Availability Impact	Low

Serv-U Windows

CVSS 3.1

Product Status

Vendor	SolarWinds
Product	Serv-U
Versions	Default: unaffected Version 15.5.4 HF1 and below is affected

Solutions

SolarWinds recommends customers to upgrade to Serv-U version 2026.3 as soon as is practical.

Credits

Intigriti Bug Bounty Program finder

References

Problem Types

CWE-862 Missing Authorization CWE

Impacts

CAPEC-233 Privilege Escalation