SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution as root. A domain account with admin privileges and read and write access to the home directory is required. The impact is lower in Windows deployments.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:HSolarwinds Serv U
APPSolarwinds< 2026.3
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCEIDOR
CWE
Related vulnerabilities
CVE-2021-35211CRITICAL9.0⚠ KEVPL ✓same product
RCE w SolarWinds Serv-U — podatność Remote Memory Escape
CVE-2026-28306CRITICAL9.1PL ✓same product
SolarWinds Serv-U: privilege escalation administratora domeny do systemu
CVE-2026-28304CRITICAL9.1PL ✓same product
SolarWinds Serv-U — zdalne wykonanie kodu jako root (RCE)
CVE-2026-28302CRITICAL9.1PL ✓same product
SolarWinds Serv-U: IDOR umożliwiający privilege escalation i RCE jako root
CVE-2026-28307CRITICAL9.1PL ✓same product
SolarWinds Serv-U: privilege escalation z grupy domenowej do administratora