AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

SolarWindsCVE-2026-28302

SolarWinds Serv-U: insecure direct object reference

SolarWinds

CVE-2026-28302 · Published Jul 21, 2026 · updated Jul 24, 2026

Critical9.1
No fix yet
SolarWinds advisory

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation and remote code execution as root. This issue requires group administrator access. The impact is lower in Windows deployments.

Affected versions

PackageAffectedFixed in
Serv-U
Product
<= 15.5.4 HF1 and belowNo fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-639

More SolarWinds advisories

All SolarWinds
Critical 9.1Jul 21SolarWinds Serv-U: insecure direct object referenceCVE-2026-28317no fix yetCritical 9.1Jul 21SolarWinds Serv-U: improper access controlCVE-2026-28321no fix yetCritical 9.1Jul 21SolarWinds Serv-U: privilege escalationCVE-2026-28312no fix yetCritical 9.1Jul 21SolarWinds Serv-U: insecure direct object referenceCVE-2026-28313no fix yetCritical 9.1Jul 21SolarWinds Serv-U: insecure direct object referenceCVE-2026-28314no fix yetMedium 6.2Jul 21SolarWinds Serv-U: cross-site scriptingCVE-2026-28315no fix yet