CVE-2026-28313 PUBLISHED

SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability

Assigner: SolarWinds
Reserved: 26.02.2026 Published: 21.07.2026 Updated: 21.07.2026

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to SMTP hijacking leading to arbitrary account takeover. The impact is lower in Windows deployments.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS Score: 9.1

Serv-U Linux

Attack Vector	Network	Scope	Changed
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	High	Integrity Impact	High
User Interaction	None	Availability Impact	High

Serv-U Linux

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
CVSS Score: 4.7

Serv-U Windows

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	Low
Privileges Required	High	Integrity Impact	Low
User Interaction	None	Availability Impact	Low

Serv-U Windows

CVSS 3.1

Product Status

Vendor	SolarWinds
Product	Serv-U
Versions	Default: unaffected Version 15.5.4 HF1 and below is affected

Solutions

SolarWinds recommends customers upgrade to Serv-U version 2026.3 as soon as is practical.

Credits

Intigriti Bug Bounty Program finder

References

Problem Types

CWE-639 Authorization Bypass Through User-Controlled Key CWE

Impacts

CAPEC-122 Privilege Abuse