CVE-2026-28302CWE-639

SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability

Critical · published July 21, 2026

CVSS v3.1
9.1
EPSS
1%
Percentile
55.6
In the wild
Unconfirmed
What it is

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation and remote code execution as root. This issue requires group administrator access. The impact is lower in Windows deployments.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00786 · 55.6th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-07-21T15:31Z
EPSS history
Timeline
  • 21 JUL 15:31Z
    SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability
    cvelistv5