AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

SolarWindsCVE-2026-28315

SolarWinds Serv-U: cross-site scripting

SolarWinds

CVE-2026-28315 · Published Jul 21, 2026 · updated Jul 24, 2026

Medium6.2
No fix yet
SolarWinds advisory

SolarWinds Serv-U was found to be affected by a stored cross-site scripting vulnerability that could lead to session hijacking or information disclosure from an administrator account.

Affected versions

PackageAffectedFixed in
Serv-U
Product
<= 15.5.4 HF1 and belowNo fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-79

More SolarWinds advisories

All SolarWinds
Critical 9.1Jul 21SolarWinds Serv-U: insecure direct object referenceCVE-2026-28317no fix yetCritical 9.1Jul 21SolarWinds Serv-U: improper access controlCVE-2026-28321no fix yetCritical 9.1Jul 21SolarWinds Serv-U: privilege escalationCVE-2026-28312no fix yetCritical 9.1Jul 21SolarWinds Serv-U: insecure direct object referenceCVE-2026-28313no fix yetCritical 9.1Jul 21SolarWinds Serv-U: insecure direct object referenceCVE-2026-28314no fix yetCritical 9.1Jul 21SolarWinds Serv-U: insecure direct object referenceCVE-2026-28316no fix yet