CVE-2026-28302: SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability
SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation and remote code execution as root. This issue requires group administrator access. The impact is lower in Windows deployments.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SolarWinds Serv-Uto a version that resolves this vulnerability.Fixed in 2026.3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28302?
CVE-2026-28302 has a severity rating of critical with a score of 9.1.
How do I fix CVE-2026-28302?
To fix CVE-2026-28302, ensure that you update SolarWinds Serv-U to the latest version provided by the vendor.
What types of access are required to exploit CVE-2026-28302?
CVE-2026-28302 requires group administrator access for exploitation.
What is the potential impact of CVE-2026-28302?
CVE-2026-28302 can lead to privilege escalation and remote code execution as root.
Is the impact of CVE-2026-28302 lower in any specific environments?
Yes, the impact of CVE-2026-28302 is lower in Windows deployments compared to others.