SolarWindsCVE-2026-28302
SolarWinds Serv-U: insecure direct object reference
Critical9.1CVE-2026-28302 · Published Jul 21, 2026 · updated Jul 24, 2026
SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation and remote code execution as root. This issue requires group administrator access. The impact is lower in Windows deployments.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Serv-U Product | <= 15.5.4 HF1 and below | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-639
More SolarWinds advisories
All SolarWinds| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jul 21 | SolarWinds Serv-U: insecure direct object reference | Critical9.1 | No fix yet |
| Jul 21 | SolarWinds Serv-U: improper access control | Critical9.1 | No fix yet |
| Jul 21 | SolarWinds Serv-U: privilege escalation | Critical9.1 | No fix yet |
| Jul 21 | SolarWinds Serv-U: insecure direct object reference | Critical9.1 | No fix yet |
| Jul 21 | SolarWinds Serv-U: insecure direct object reference | Critical9.1 | No fix yet |
| Jul 21 | SolarWinds Serv-U: cross-site scripting | Medium6.2 | No fix yet |