CVE-2026-28304
SolarWinds Serv‑U has a critical remote code execution flaw that lets an attacker run any code on the server as the root user. The vulnerability is exploitable over the network and can be used to take full control of the affected system. Windows deployments are less severely impacted.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
SolarWinds Serv‑U (all versions; no specific version list provided).
Real-world impact
An attacker who exploits this flaw can execute arbitrary code with root privileges, potentially compromising the entire server, data, and network. On Windows installations the impact is reduced, but the risk remains significant.
Why this severity
The CVSS score of 9.1 reflects a network‑based attack that requires low effort, grants high privileges, and can compromise confidentiality, integrity, and availability. The high impact and ease of exploitation make it a critical vulnerability.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jul 21, 2026 · 11d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 8d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- documentation.solarwinds.com/en/success_center/servu/con…release notesvendor advisory
- solarwinds.com/trust-center/security-advis…vendor advisory