CVE-2026-28314

CriticalCVSS 9.1

Published: 21/07/2026(UTC)Updated: 24/07/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.45%

36th percentile - higher than 36% of all known CVEs

Summary

Vulnerability in SolarWinds Serv-U involving insecure direct object reference (IDOR) allows account takeover. Authentication is required, impact is lower on Windows deployments.

Risk Assessment

An authenticated attacker can take over other user accounts, leading to unauthorized data access.

Recommendation

Update SolarWinds Serv-U to the latest patched version.

Original NVD description (English source)

SolarWinds Serv-U is affected by an insecure direct object reference vulnerability that leads to an account takeover. User authentication is required. The impact is lower in Windows deployments.