CVE-2026-28321 SolarWinds Serv-U Broken Access Control Vulnerability

What is CVE-2026-28321?

CVE-2026-28321 is a critical missing authorization vulnerability in Solarwinds Serv-U, published on 21 Jul 2026. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

SolarWinds Serv-U is affected by a broken access control vulnerability that could allow arbitrary file read and write, which can then be used to escalate privileges and execute code as root. A domain administrator access is required, and the impact is lower in Windows installations.

Weakness: CWE-284

Which versions are affected by CVE-2026-28321?

It affects 1 product.

Products include Solarwinds Serv-U.

How do I fix CVE-2026-28321?

No fix has been published for CVE-2026-28321 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-28321 being exploited?

There is no known exploitation of CVE-2026-28321 in the wild and no public exploit code.

Other vulnerabilities in Solarwinds Serv-U

• CVE-2021-35211 SolarWinds Serv-U Remote Code Execution Exploited Critical 9.0
• CVE-2024-28995 SolarWinds Serv-U Path Traversal Vulnerability Exploited High 8.6
• CVE-2026-28318 SolarWinds Serv-U Uncontrolled Resource Consumption Exploited High 7.5
• CVE-2021-35247 SolarWinds Serv-U Improper Input Validation Exploited Medium 4.3
• CVE-2020-35481 Code injection in n/a Critical 9.8

All Solarwinds Serv-U vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-qmpv-cmj3-27m6.