by Kastro
Paper/Archive/CVE-2026-28308

CVE-2026-28308

SolarWinds Serv-U — SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability

EPSS 0.8%CVSS 9.1
critical.is priorityof 100
39
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 56.1.561 × 2011.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution. Domain administrator access is required. The impact is lower in Windows deployments.

Affected

ProductAffectedFixed inSource
Serv-U15.5.4 HF1 and below–CNA

Scores by source

SolarWinds (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisorysolarwinds.com/trust-center/security-advisories/CVE-2026-28308refdocumentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_2026-3_release_notes.htm