AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

SolarWindsCVE-2026-28314

SolarWinds Serv-U: insecure direct object reference

SolarWinds

CVE-2026-28314 · Published Jul 21, 2026 · updated Jul 24, 2026

Critical9.1
No fix yet
SolarWinds advisory

SolarWinds Serv-U is affected by an insecure direct object reference vulnerability that leads to an account takeover. User authentication is required. The impact is lower in Windows deployments.

Affected versions

PackageAffectedFixed in
Serv-U
Product
<= 15.5.4 HF1 and belowNo fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-639

More SolarWinds advisories

All SolarWinds
Critical 9.1Jul 21SolarWinds Serv-U: insecure direct object referenceCVE-2026-28317no fix yetCritical 9.1Jul 21SolarWinds Serv-U: improper access controlCVE-2026-28321no fix yetCritical 9.1Jul 21SolarWinds Serv-U: privilege escalationCVE-2026-28312no fix yetCritical 9.1Jul 21SolarWinds Serv-U: insecure direct object referenceCVE-2026-28313no fix yetMedium 6.2Jul 21SolarWinds Serv-U: cross-site scriptingCVE-2026-28315no fix yetCritical 9.1Jul 21SolarWinds Serv-U: insecure direct object referenceCVE-2026-28316no fix yet