← All Advisories

SolarWinds Serv-U IDOR Vulnerability Lets Group Administrators Reference Out-of-Scope Objects to Escalate Privileges and Execute Code as Root

Last refreshed2026-09-28

Status: UPDATED  |  Advisory ID: CVE-2026-28302

Key Details

CVECVE-2026-28302
CVSS Score / Version9.1 (Critical) / CVSS v3.1
Updated2026-07-24
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS Proseattack vector is network; attack complexity is low; privileges required is high; user interaction is none; scope is changed; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected productsSolarWinds Serv-U
Classified asCWE-639 (Authorization Bypass Through User-Controlled Key)

Affected Products, Subsystems & Sectors

VendorProductAffected VersionsPatch Status
SolarWindsServ-U
SubsystemsGeneral OT
SectorsMultiple

What to Know

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation and remote code execution as root. This issue requires group administrator access. The impact is lower in Windows deployments. (NVD)

What to Do

Monitor SolarWinds's web page for any future patch releases. See vendor advisory link below.

References

SourceReference
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-28302
CVEhttps://www.cve.org/CVERecord?id=CVE-2026-28302
Vendor advisoryhttps://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28302