CVE-2026-28317

CriticalCVSS 9.1

Published: 21/07/2026(UTC)Updated: 24/07/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.34%

27th percentile - higher than 27% of all known CVEs

Summary

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation. Requires domain administrator access. Impact is lower in Windows deployments.

Risk Assessment

Risk of privilege escalation by a domain administrator, potentially enabling unauthorized access to sensitive resources.

Recommendation

Upgrade to the latest version of SolarWinds Serv-U and implement additional access controls for domain administrators.

Original NVD description (English source)

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation. This issue requires domain administrator access. The impact is lower in Windows deployments.