CVE Catalog
CVE-2026-28308
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk0.55%
43th percentile - higher than 43% of all known CVEs
Summary
SolarWinds Serv-U is affected by an IDOR vulnerability that can lead to remote code execution. Domain administrator access is required. Impact is lower on Windows deployments.
Risk Assessment
An attacker with domain administrator access can remotely execute code on the server, potentially leading to full system compromise.
Recommendation
Update SolarWinds Serv-U to the latest version. Limit the number of accounts with domain administrator privileges.
Original NVD description (English source)
SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution. Domain administrator access is required. The impact is lower in Windows deployments.