PT-2026-61971 · Solarwinds · Serv-U

CVE-2026-28313 · Published 2026-07-21 · Updated 2026-07-21

NVD

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to SMTP hijacking leading to arbitrary account takeover. The impact is lower in Windows deployments.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-28313

Affected Products

Serv-U

References · 3

• https://https//www.solarwinds.com/trust-center/security-advisories/CVE-2026-28313 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-28313 · Security Note
• https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_2026-3_release_notes.htm · Note