PT-2026-61975 · Solarwinds · Serv-U

CVE-2026-28317 · Published 2026-07-21 · Updated 2026-07-21

Mitre

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation. This issue requires domain administrator access. The impact is lower in Windows deployments.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-28317

Affected Products

Serv-U

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-28317 · Security Note
• https://solarwinds.com/trust-center/security-advisories/CVE-2026-28317 · Vendor Advisory
• https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_2026-3_release_notes.htm · Note