CRITICAL🇵🇱 Wersja polska

CVE-2026-28302

CVSS 9.1v3.1pub. 2026-07-21upd. 2026-07-24

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation and remote code execution as root. This issue requires group administrator access. The impact is lower in Windows deployments.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

  • Solarwinds Serv U

    APP
    Solarwinds
    < 2026.3
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCELPEIDOR
CWE
References

Related vulnerabilities

CVE-2021-35211CRITICAL9.0⚠ KEVPL ✓same product

RCE w SolarWinds Serv-U — podatność Remote Memory Escape

CVE-2026-28306CRITICAL9.1PL ✓same product

SolarWinds Serv-U: privilege escalation administratora domeny do systemu

CVE-2026-28305CRITICAL9.1PL ✓same product

SolarWinds Serv-U: IDOR umożliwiający RCE jako root

CVE-2026-28304CRITICAL9.1PL ✓same product

SolarWinds Serv-U — zdalne wykonanie kodu jako root (RCE)

CVE-2026-28307CRITICAL9.1PL ✓same product

SolarWinds Serv-U: privilege escalation z grupy domenowej do administratora