PT-2026-61967 · Solarwinds · Serv-U

CVE-2026-28308 · Published 2026-07-21 · Updated 2026-07-21

NVD

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution. Domain administrator access is required. The impact is lower in Windows deployments.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-28308

Affected Products

Serv-U

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-28308 · Security Note
• https://solarwinds.com/trust-center/security-advisories/CVE-2026-28308 · Vendor Advisory
• https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_2026-3_release_notes.htm · Note