CVE-2026-28313 SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability

What is CVE-2026-28313?

CVE-2026-28313 is a critical missing authorization vulnerability in Solarwinds Serv-U, published on 21 Jul 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to SMTP hijacking leading to arbitrary account takeover. The impact is lower in Windows deployments.

Weakness: CWE-639

Which versions are affected by CVE-2026-28313?

It affects 1 product.

Products include Solarwinds Serv-U.

How do I fix CVE-2026-28313?

No fix has been published for CVE-2026-28313 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-28313 being exploited?

There is no known exploitation of CVE-2026-28313 in the wild and no public exploit code.

Other vulnerabilities in Solarwinds Serv-U

• CVE-2021-35211 SolarWinds Serv-U Remote Code Execution Exploited Critical 9.0
• CVE-2024-28995 SolarWinds Serv-U Path Traversal Vulnerability Exploited High 8.6
• CVE-2026-28318 SolarWinds Serv-U Uncontrolled Resource Consumption Exploited High 7.5
• CVE-2021-35247 SolarWinds Serv-U Improper Input Validation Exploited Medium 4.3
• CVE-2020-35481 Code injection in n/a Critical 9.8

All Solarwinds Serv-U vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-wpw8-5vq9-3rp5.