CVE-2026-28302: SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation and remote code execution as…

PriorityP358critical9.1CVSS 3.1

AVNACLPRHUINSCCHIHAH

EPSS

0.72%

52.3th percentile

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation and remote code execution as root. This issue requires group administrator access. The impact is lower in Windows deployments.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
solarwinds	serv-u	< 2026.3	2026.3
solarwinds	serv-u	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.