CVE Catalog
CVE-2026-28302
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk0.56%
43th percentile - higher than 43% of all known CVEs
Summary
SolarWinds Serv-U is affected by an IDOR vulnerability that can lead to privilege escalation and remote code execution as root. Group administrator access is required. Impact is lower on Windows deployments.
Risk Assessment
An attacker with group administrator access can gain full root control of the server and execute arbitrary code.
Recommendation
Update SolarWinds Serv-U to the latest version. Limit the number of accounts with group administrator privileges.
Original NVD description (English source)
SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation and remote code execution as root. This issue requires group administrator access. The impact is lower in Windows deployments.