[ CVE-2026-28308 · Published 21 Jul 2026 ]
Vulnerability in SolarWinds Serv-U
CVSS 9.1
EPSS <1%1 agency advisoryFix available
[ Why it matters ]Priority signals
- Critical severity: CVSS 9.1
[ Description ]Official description
SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution. Domain administrator access is required. The impact is lower in Windows deployments.
[ Fixes ]Fixes and patches
- Security bulletin: SolarWinds cve-2026-28331Vendor patch or bulletin · CERT-FR · solarwinds.com/trust-center/security-advisories/cve-2026-28331, cited by CERT-FR CERTFR-2026-AVI-1364
- Security bulletin: SolarWinds cve-2026-28328Vendor patch or bulletin · CERT-FR · solarwinds.com/trust-center/security-advisories/cve-2026-28328, cited by CERT-FR CERTFR-2026-AVI-1364
- Security bulletin: SolarWinds cve-2026-28329Vendor patch or bulletin · CERT-FR · solarwinds.com/trust-center/security-advisories/cve-2026-28329, cited by CERT-FR CERTFR-2026-AVI-1364
- Security bulletin: SolarWinds cve-2026-28330Vendor patch or bulletin · CERT-FR · solarwinds.com/trust-center/security-advisories/cve-2026-28330, cited by CERT-FR CERTFR-2026-AVI-1364
[ Advisories ]Government CERT advisories
-
CERT-FRCERTFR-2026-AVI-1364
Multiple vulnerabilities in SolarWinds products Translated from French
Multiple vulnerabilities have been discovered in SolarWinds products. Some of them allow an attacker to cause privilege escalation, server-side request forgery (SSRF) and remote cross-site scripting (XSS).