CVE-2026-28302 | SolarWinds Serv-U is affected by an insecure direct object r… | CVSS 9.1 CRITICAL

Description

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation and remote code execution as root. This issue requires group administrator access. The impact is lower in Windows deployments.

Metadata

CVE ID: CVE-2026-28302
State: PUBLISHED
Assigner: SolarWinds
Reserved: 2026-02-26 14:15 UTC
Published: 2026-07-21 15:31 UTC
Last updated: 2026-07-21 15:31 UTC
Primary CWE: CWE-639
CWE-639 Authorization Bypass Through User-Controlled Key
Vendor / Product: SolarWinds / Serv-U
Sources: cve.org · NVD

Severity & Metrics

9.1 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Affected products (1)

Vendor	Product	Platform	Versions
SolarWinds	Serv-U	Windows,Linux	15.5.4 HF1 and below

Weakness (CWE)

CWE	Source	Description
CWE-639	cna	CWE-639 Authorization Bypass Through User-Controlled Key

CVSS scores (2)

Score	Severity	Version	Source	Vector
9.1	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
4.7	MEDIUM	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

References (2)