CVE-2026-28305 SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability

What is CVE-2026-28305?

CVE-2026-28305 is a critical missing authorization vulnerability in Solarwinds Serv-U, published on 21 Jul 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution as root. A domain account with admin privileges and read and write access to the home directory is required. The impact is lower in Windows deployments.

Weakness: CWE-639

Which versions are affected by CVE-2026-28305?

It affects 1 product.

Products include Solarwinds Serv-U.

How do I fix CVE-2026-28305?

No fix has been published for CVE-2026-28305 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-28305 being exploited?

There is no known exploitation of CVE-2026-28305 in the wild and no public exploit code.

Other vulnerabilities in Solarwinds Serv-U

• CVE-2021-35211 SolarWinds Serv-U Remote Code Execution Exploited Critical 9.0
• CVE-2024-28995 SolarWinds Serv-U Path Traversal Vulnerability Exploited High 8.6
• CVE-2026-28318 SolarWinds Serv-U Uncontrolled Resource Consumption Exploited High 7.5
• CVE-2021-35247 SolarWinds Serv-U Improper Input Validation Exploited Medium 4.3
• CVE-2020-35481 Code injection in n/a Critical 9.8

All Solarwinds Serv-U vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-wv2m-rg59-7rh5.