CVE-2026-28308 | SolarWinds Serv-U is affected by an insecure direct object r… | CVSS 9.1 CRITICAL

Description

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution. Domain administrator access is required. The impact is lower in Windows deployments.

Metadata

CVE ID: CVE-2026-28308
State: PUBLISHED
Assigner: SolarWinds
Reserved: 2026-02-26 14:28 UTC
Published: 2026-07-21 15:34 UTC
Last updated: 2026-07-21 15:34 UTC
Primary CWE: CWE-639
CWE-639 Authorization Bypass Through User-Controlled Key
Vendor / Product: SolarWinds / Serv-U
Sources: cve.org · NVD

Severity & Metrics

9.1 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Affected products (1)

Vendor	Product	Platform	Versions
SolarWinds	Serv-U	—	15.5.4 HF1 and below

Weakness (CWE)

CWE	Source	Description
CWE-639	cna	CWE-639 Authorization Bypass Through User-Controlled Key

CVSS scores (2)

Score	Severity	Version	Source	Vector
9.1	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
4.7	MEDIUM	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

References (2)