Critical severity9.1NVD Advisory· Published Jul 21, 2026· Updated Jul 24, 2026
CVE-2026-28302
CVE-2026-28302
Description
SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation and remote code execution as root. This issue requires group administrator access. The impact is lower in Windows deployments.
Affected products
2cpe:2.3:a:solarwinds:serv-u:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:solarwinds:serv-u:*:*:*:*:*:*:*:*range: <2026.3
- (no CPE)
Patches
Vulnerability mechanics
References
2News mentions
2- ⚡ Weekly Recap: Rogue AI Models, $88M Bitcoin Theft, Water-System Attacks and Dangling DNS HijacksThe Hacker News · Aug 3, 2026
- SolarWinds Patches 15 Critical Serv-U Flaws That Could Hand Attackers Root AccessCyber Security News · Jul 22, 2026