Vulnerability intelligence

CVE-2026-28308

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution. Domain administrator access is required. The impact is lower in Windows deployments.

CVSS Score

9.1

Critical

EPSS — Exploit Probability

0.0%

Riskier than 0% of all CVEs

Exploitation

Not in CISA KEV

No federal exploitation record

Remediation

unknown

Check vendor advisories

NVD entry PoC / advisory

1 article across 1 outlet · first covered Jul 21, 2026 · latest Jul 21, 2026

Coverage timeline

SolarWinds Patches Three Critical Serv-U Vulnerabilities Enabling RCE
securityonline.info · Jul 21, 2026