9.1Kritisch
CVE-2026-28308SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability
Beschreibung
SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution. Domain administrator access is required. The impact is lower in Windows deployments.
Schwachstellentyp (CWE):
CWE-639
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| SolarWinds | Serv-U | 15.5.4 HF1 and below |
Referenzen und Patches
- https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28308 vendor-advisoryVendor Advisory
- https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_2026-3_release_notes.htm Release NotesVendor Advisory
CPE-Treffer (NVD) (1)
cpe:2.3:a:solarwinds:serv-u:*:*:*:*:*:*:*:*< 2026.3