Critical severity9.1NVD Advisory· Published Jul 21, 2026· Updated Jul 24, 2026
CVE-2026-28302
CVE-2026-28302
Description
SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation and remote code execution as root. This issue requires group administrator access. The impact is lower in Windows deployments.
Affected products
2cpe:2.3:a:solarwinds:serv-u:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:solarwinds:serv-u:*:*:*:*:*:*:*:*range: <2026.3
- (no CPE)
Patches
Vulnerability mechanics
References
2News mentions
4- ⚡ Weekly Recap: Cisco 0-Day, AI Agent RCE, ClickFix Attacks, ClickFix Surge, and Browser HijacksThe Hacker News · Sep 21, 2026
- SolarWinds Patches ARM Hard-Coded Key Flaw Enabling Unauthenticated RCEThe Hacker News · Sep 19, 2026
- ⚡ Weekly Recap: Rogue AI Models, $88M Bitcoin Theft, Water-System Attacks and Dangling DNS HijacksThe Hacker News · Aug 3, 2026
- SolarWinds Patches 15 Critical Serv-U Flaws That Could Hand Attackers Root AccessCyber Security News · Jul 22, 2026