Vulnerability intelligence
CVE-2026-28308
SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution. Domain administrator access is required. The impact is lower in Windows deployments.
CVSS Score
9.1
Critical
EPSS — Exploit Probability
0.8%
Riskier than 53% of all CVEs · checked 2026-09-05
Exploitation
Not in CISA KEV
KEV does not include every exploited vulnerability
Remediation
unknown
Check vendor advisories
1 article across 1 outlet · first covered Jul 21, 2026 · latest Jul 21, 2026
Coverage timeline
-
SolarWinds Patches Three Critical Serv-U Vulnerabilities Enabling RCEsecurityonline.info · Jul 21, 2026