CVE-2026-28317

SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability

State: Published
Severity: 9.1 Critical
Published: Jul 21, 2026
Updated: Jul 24, 2026
Reserved: Feb 26, 2026

Description

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation. This issue requires domain administrator access. The impact is lower in Windows deployments.

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H	SolarWinds
3.1	4.7 Medium	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L	SolarWinds

Weaknesses

CWE-639 Authorization Bypass Through User-Controlled Key

Affected Products

Product	Versions
Serv-USolarWinds	15.5.4 HF1 and belowAffected

References

https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28317vendor-advisory
https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_2026-3_release_notes.htmrelease-notes

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.