PT-2026-61963 · Solarwinds · Serv-U

CVE-2026-28304 · Published 2026-07-21 · Updated 2026-07-21

NVD

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

SolarWinds Serv-U is affected by a remote code execution vulnerability that, when exploited, can allow the arbitrary execution of code remotely as root. The impact is lower in Windows deployments.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-28304

Affected Products

Serv-U

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-28304 · Security Note
• https://solarwinds.com/trust-center/security-advisories/CVE-2026-28304 · Vendor Advisory
• https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_2026-3_release_notes.htm · Note