SolarWinds Serv-U IDOR Vulnerability Allows a Domain Administrator with Home Directory Access to Reference Out-of-Scope Objects, Enabling Remote Code Execution as Root

Last refreshed2026-09-28

Status: UPDATED | Advisory ID: CVE-2026-28305

Key Details

CVE	CVE-2026-28305
CVSS Score / Version	9.1 (Critical) / CVSS v3.1
Updated	2026-07-24
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H`
CVSS Prose	attack vector is network; attack complexity is low; privileges required is high; user interaction is none; scope is changed; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	SolarWinds Serv-U
Classified as	CWE-639 (Authorization Bypass Through User-Controlled Key)

Affected Products, Subsystems & Sectors

Vendor	Product	Affected Versions	Patch Status
SolarWinds	Serv-U

Vendor

Product

Affected Versions

Patch Status

SolarWinds

Serv-U

Subsystems	General OT
Sectors	Multiple

What to Know

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution as root. A domain account with admin privileges and read and write access to the home directory is required. The impact is lower in Windows deployments. (NVD)

What to Do

Monitor SolarWinds's web page for any future patch releases. See vendor advisory link below.

References

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-28305
CVE	https://www.cve.org/CVERecord?id=CVE-2026-28305
Vendor advisory	https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_2026-3_release_notes.htm

Source

Reference

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-28305

CVE

https://www.cve.org/CVERecord?id=CVE-2026-28305

Vendor advisory