CVE-2026-28314 SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability

What is CVE-2026-28314?

CVE-2026-28314 is a critical missing authorization vulnerability in Solarwinds Serv-U, published on 21 Jul 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

SolarWinds Serv-U is affected by an insecure direct object reference vulnerability that leads to an account takeover. User authentication is required. The impact is lower in Windows deployments.

Weakness: CWE-639

Which versions are affected by CVE-2026-28314?

It affects 1 product.

Products include Solarwinds Serv-U.

How do I fix CVE-2026-28314?

No fix has been published for CVE-2026-28314 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-28314 being exploited?

There is no known exploitation of CVE-2026-28314 in the wild and no public exploit code.

Other vulnerabilities in Solarwinds Serv-U

• CVE-2021-35211 SolarWinds Serv-U Remote Code Execution Exploited Critical 9.0
• CVE-2024-28995 SolarWinds Serv-U Path Traversal Vulnerability Exploited High 8.6
• CVE-2026-28318 SolarWinds Serv-U Uncontrolled Resource Consumption Exploited High 7.5
• CVE-2021-35247 SolarWinds Serv-U Improper Input Validation Exploited Medium 4.3
• CVE-2020-35481 Code injection in n/a Critical 9.8

All Solarwinds Serv-U vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-w6hc-qj8r-4mjx.