by Kastro
Paper/Archive/CVE-2026-28313

CVE-2026-28313

SolarWinds Serv-U — SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability

EPSS 0.5%CVSS 9.1
critical.is priorityof 100
36
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 42.5.425 × 208.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to SMTP hijacking leading to arbitrary account takeover. The impact is lower in Windows deployments.

Affected

ProductAffectedFixed inSource
Serv-U15.5.4 HF1 and below–CNA

Scores by source

SolarWinds (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisoryhttps://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28313refdocumentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_2026-3_release_notes.htm