CVE-2026-28302

critical · 9.1

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation and remote code execution as root. This issue requires group administrator access. The impact is lower in Windows deployments.

9.1

CVSS

0.7%

EPSS (exploit prob.)

52nd

EPSS percentile

2026-07-21

Published

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-639

Affected products

Vendor	Product	Affected versions
solarwinds	serv-u	< 2026.3

Check a specific version with /api/v1/cve/match.

References

https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_2026-3_release_notes.htm
https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28302

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-28302