CVE-2026-28317
SolarWinds Serv‑U has a critical flaw that lets attackers with domain administrator rights gain even more privileges. The vulnerability is an insecure direct object reference that can be abused to elevate privileges. It is especially dangerous in environments where domain admin accounts are used.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
SolarWinds Serv‑U (all versions) – the web‑based file transfer server.
Real-world impact
An attacker who can already act as a domain administrator could use the flaw to further increase their privileges, potentially taking full control of the Serv‑U server and the underlying system.
Why this severity
The CVSS score of 9.1 reflects that the flaw can be exploited over the network (AV:N), requires only low effort (AC:L), and gives an attacker high privileges (PR:H). Because the impact is complete (S:C) and can compromise confidentiality, integrity, and availability (C:H/I:H/A:H), the score is critical.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jul 21, 2026 · 11d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 8d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- documentation.solarwinds.com/en/success_center/servu/con…release notesvendor advisory
- solarwinds.com/trust-center/security-advis…vendor advisory