CVE-2026-28321
SolarWinds Serv‑U has a broken access control flaw that lets a user with domain‑administrator rights read and write any file on the system. This can be used to gain root privileges and run arbitrary code. The vulnerability is critical because it can be exploited remotely over the network.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
SolarWinds Serv‑U (all versions, no specific version list available).
Real-world impact
An attacker who can reach the Serv‑U server and has domain‑administrator credentials can read sensitive files, modify or delete them, and then elevate privileges to run code as the root user, potentially taking full control of the affected machine.
Why this severity
The CVSS score of 9.1 reflects a network‑based attack (AV:N) that requires low effort (AC:L) but high privileges (PR:H). The vulnerability is exploitable without user interaction (UI:N) and is a complete compromise (S:C) with high impact on confidentiality, integrity, and availability (C:H/I:H/A:H).
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jul 21, 2026 · 11d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 8d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- documentation.solarwinds.com/en/success_center/servu/con…release notesvendor advisory
- solarwinds.com/trust-center/security-advis…vendor advisory