CVE-2026-28308
SolarWinds Serv‑U has a flaw that lets an attacker with domain‑administrator rights access files or functions they shouldn’t. This can let the attacker run code on the server. The problem is less severe on Windows installations.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
SolarWinds Serv‑U (all versions, no specific CPEs listed).
Real-world impact
An attacker who can act as a domain administrator could run arbitrary code on the Serv‑U server, potentially taking control of the system and accessing sensitive data.
Why this severity
The CVSS score of 9.1 reflects that the vulnerability can compromise confidentiality, integrity, and availability, requires only a domain‑admin account (high privileges but no user interaction), and has low attack complexity. These factors combine to give a critical rating.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jul 21, 2026 · 11d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 8d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- documentation.solarwinds.com/en/success_center/servu/con…release notesvendor advisory
- solarwinds.com/trust-center/security-advis…vendor advisory