CVE-2026-28313

CriticalCVSS 9.1

Published: 21/07/2026(UTC)Updated: 24/07/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

27th percentile - higher than 27% of all known CVEs

Summary

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to SMTP hijacking leading to arbitrary account takeover. Impact is lower in Windows deployments.

Risk Assessment

Risk of account takeover via SMTP hijacking, potentially leading to confidentiality and integrity breaches.

Recommendation

Upgrade to the latest version of SolarWinds Serv-U and monitor SMTP activity for suspicious behavior.

Original NVD description (English source)

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to SMTP hijacking leading to arbitrary account takeover. The impact is lower in Windows deployments.