Status: UPDATED | Advisory ID: CVE-2026-28302
| CVE | CVE-2026-28302 |
| CVSS Score / Version | 9.1 (Critical) / CVSS v3.1 |
| Updated | 2026-07-24 |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
| CVSS Prose | attack vector is network; attack complexity is low; privileges required is high; user interaction is none; scope is changed; confidentiality impact is high; integrity impact is high; availability impact is high. |
| Affected products | SolarWinds Serv-U |
| Classified as | CWE-639 (Authorization Bypass Through User-Controlled Key) |
| Vendor | Product | Affected Versions | Patch Status |
|---|---|---|---|
| SolarWinds | Serv-U |
| Subsystems | General OT |
| Sectors | Multiple |
SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation and remote code execution as root. This issue requires group administrator access. The impact is lower in Windows deployments. (NVD)
Monitor SolarWinds's web page for any future patch releases. See vendor advisory link below.