Multiple vulnerabilities have been identified in SolarWinds Serv-U file transfer software. The vulnerabilities include remote code execution, insecure direct object reference, and broken access control, which could allow attackers to gain elevated privileges and execute code with root user access. This poses a significant business risk, as successful exploitation could lead to unauthorized access, data breaches, and disruption of critical operations.
CVE-2026-28302 (CVSS 9.1 — Critical): An insecure direct object reference (IDOR) vulnerability in SolarWinds Serv-U allows attackers with group administrator access to escalate privileges and execute remote code with root-level access, with reduced impact on Windows deployments.[/subscribe_to_unlock_form]
Multiple vulnerabilities have been identified in SolarWinds Serv-U file transfer software. The vulnerabilities include remote code execution, insecure direct object reference, and broken access control, which could allow attackers to gain elevated privileges and execute code with root user access. This poses a significant business risk, as successful exploitation could lead to unauthorized access, data breaches, and disruption of critical operations.
CVE-2026-28302 (CVSS 9.1 — Critical): An insecure direct object reference (IDOR) vulnerability in SolarWinds Serv-U allows attackers with group administrator access to escalate privileges and execute remote code with root-level access, with reduced impact on Windows deployments.[emaillocker id="1283"]
CVE-2026-28304 (CVSS 9.1 — Critical): A remote code execution vulnerability in SolarWinds Serv-U allows attackers to execute arbitrary code remotely with root privileges, while the impact is reduced in Windows deployments.
CVE-2026-28305 (CVSS 9.1 — Critical): An insecure direct object reference (IDOR) vulnerability in SolarWinds Serv-U allows attackers with domain administrator privileges and read/write access to the home directory to execute remote code as root, with reduced impact on Windows deployments.
CVE-2026-28306 (CVSS 9.1 — Critical): A privilege escalation vulnerability in SolarWinds Serv-U allows a domain administrator to elevate privileges to system administrator level, with reduced impact in Windows deployments.
CVE-2026-28307 (CVSS 9.1 — Critical): A privilege escalation vulnerability in SolarWinds Serv-U allows a domain user group to be elevated into an administrator group, with reduced impact in Windows deployments.
CVE-2026-28308 (CVSS 9.1 — Critical): An insecure direct object reference (IDOR) vulnerability in SolarWinds Serv-U allows attackers with domain administrator access to execute remote code, with reduced impact in Windows deployments.
CVE-2026-28309 (CVSS 9.1 — Critical): A broken access control vulnerability in SolarWinds Serv-U allows domain administrators to create system administrator accounts, with reduced impact in Windows deployments.
CVE-2026-28310 (CVSS 9.1 — Critical): This vulnerability enables privilege escalation by promoting lower-level users or groups to system administrator roles.
CVE-2026-28311 (CVSS 9.1 — Critical): This remote code execution vulnerability allows attackers to run malicious commands on affected systems remotely.
CVE-2026-28312 (CVSS 9.1 — Critical): A privilege escalation vulnerability in SolarWinds Serv-U allows a group’s access level to be elevated to system administrator, enabling code execution with root privileges, with reduced impact in Windows deployments.
CVE-2026-28313 (CVSS 9.1 — Critical): An insecure direct object reference (IDOR) vulnerability in SolarWinds Serv-U can enable SMTP hijacking and arbitrary account takeover, with reduced impact in Windows deployments.
CVE-2026-28314 (CVSS 9.1 — Critical): An insecure direct object reference (IDOR) vulnerability in SolarWinds Serv-U allows authenticated attackers to perform account takeover, with reduced impact in Windows deployments.
CVE-2026-28315 (CVSS 6.2 — Medium): This stored XSS vulnerability exposes sensitive administrative session data or leads to session hijacking.
CVE-2026-28316 (CVSS 9.1 — Critical): An insecure direct object reference (IDOR) vulnerability in SolarWinds Serv-U allows domain administrators to escalate privileges to system administrator and execute commands as root, with reduced impact in Windows deployments.
CVE-2026-28317 (CVSS 9.1 — Critical): An insecure direct object reference (IDOR) vulnerability in SolarWinds Serv-U allows attackers with domain administrator access to escalate privileges, with reduced impact in Windows deployments.
CVE-2026-28321 (CVSS 9.1 — Critical): A broken access control vulnerability in SolarWinds Serv-U allows lower-level users or groups to be elevated to system administrator roles, enabling potential privilege escalation in enterprise deployments.
We recommend you to update SolarWinds Serv-U to version 2026.3 or later.
The following reports contain further technical details:
[/emaillocker]