CVE-2026-28302Patch(solarwinds / serv-u)

LOWCVSS 9.1 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch solarwinds serv-u systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation and remote code execution as root. This issue requires group administrator access. The impact is lower in Windows deployments.

solarwinds CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28302

Other references

https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_2026-3_release_notes.htm

Weakness type (CWE)

CWE-639

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

serv-u

Threat summary

Patch or workaround signal is available
6 mentions across 4 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 5 signals
Technical details provided in 5 signals
Disclosure: 1 classified signal
General: 1 classified signal
Peaked 3d ago at 3 mentions (2026-07-21); latest day: 1
6 total mentions across 4 days

Affected systems

Vendors

solarwinds

Products

serv-u

Deep dive

Activity timeline6 mentions / 4d

Signal classification3 categories

Patch

466.7%

Disclosure

116.7%

General

116.7%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-21	3	Disclosure1Patch2
2026-07-22	1	Patch1
2026-07-23	1	Patch1
2026-07-31	1	General1

Full discourse6 posts

GovCERT.CZ@GOVCERT_CZ90d
Patch
🚨 Upozorňujeme na sérii kritických RCE zranitelností v SolarWinds Serv-U Managed File Transfer a Serv-U Gateway, CVE-2026-28302, CVE-2026-28304, a další. Zranitelnosti se týkají verzí Serv-U 15.5.4 HF1 a starších a zahrnují IDOR, eskalaci oprávnění, porušení řízení přístupu a vzdálené spuštění kódu; jejich zneužití může autentizovanému útočníkovi umožnit eskalovat oprávnění, kompromitovat administrátorské účty, spouštět libovolný kód s oprávněním root zejména na systémech Linux, převzít účty, zneužít SMTP funkcionalitu a získat neoprávněný přístup k citlivým souborům. 📌Doporučujeme bezodkladně aktualizovat všechny instalace Serv-U na opravenou verzi Serv-U 2026.3, nebo novější.
Post summary
The post highlights critical RCE vulnerabilities in SolarWinds Serv‑U and urges users to apply the latest patch, Serv‑U 2026.3, to mitigate the risk.
02010417
4.2K followersView on X
Orizon@OrizonCyber91d
Patch
🚨 CVE-2026-28302 — CVSS 9.1/10 █████████░ SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/nWiyqkLJLn
Post summary
The tweet announces a critical IDOR vulnerability in SolarWinds Serv-U (CVE-2026-28302) with a CVSS score of 9.1/10 and urges immediate patching.
1000073
69 followersView on X
CERT-PY@CERTpy81d
General
⚠️ Vulnerabilidades en productos SolarWinds ❗ CVE-2026-28305 ❗ CVE-2026-28304 ❗ CVE-2026-28302 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-solarwinds-4/ https://t.co/FOrErS8bEO
Post summary
The tweet merely lists three SolarWinds CVE identifiers and provides a link to additional information, without disclosing any technical details, PoC, patch, or exploitation evidence.
00000185
6.7K followersView on X
TECHEPAGES@techepages91d
Patch
SolarWinds Serv-U 2026.3 patches 15 vulnerabilities — 14 Critical (CVSS 9.1) enabling privilege escalation to root RCE. List of all vulnerabilities reported in the latest security advisory: 🔵 CVE-2026-28302 🔵 CVE-2026-28304 🔵 CVE-2026-28305 🔵 CVE-2026-28306 🔵 CVE-2026-28307 🔵 CVE-2026-28308 🔵 CVE-2026-28309 🔵 CVE-2026-28310 🔵 CVE-2026-28311 🔵 CVE-2026-28312 🔵 CVE-2026-28313 🔵 CVE-2026-28314 🔵 CVE-2026-28315 (Medium — stored XSS) 🔵 CVE-2026-28316 🔵 CVE-2026-28317 🔵 CVE-2026-28321
Post summary
The SolarWinds Serv‑U 2026.3 advisory details 15 critical vulnerabilities—14 with CVSS 9.1 enabling root privilege escalation via RCE, plus a medium stored XSS—and confirms that patches are available.
0000041
31 followersView on X
Xavier Rivera@XavierRiveraX91d
Disclosure
SolarWinds Serv-U carries a critical IDOR flaw (CVE-2026-28302, CVSS 9.1): group-admin access can be escalated straight to root-level code execution. Patched in Serv-U 2026-3, but it is the kind of privilege gap that hides in plain sight. https://thecircuitry.to/article/solarwinds-serv-u-hit-by-critical-idor-flaw-cve-2026-28302-mruvuxn6
Post summary
SolarWinds Serv‑U is affected by a critical IDOR flaw (CVE‑2026‑28302) that allows group‑admin users to gain root code execution; the issue is fixed in Serv‑U 2026‑3.
0000082
599 followersView on X
Security Arsenal, LLC@SecurityAr5840991d
Patch
🔒 #CyberSecurity CVE-2026-28302: Windows Network-Exploitable RCE — Detection and Remediation "In the April 2026 Patch Tuesday release, Microsoft addressed a critical remote code execution…" 🔗 https://securityarsenal.com/blog/cve-2026-28302-windows-network-exploitable-rce-detection-and-remediation #CyberSecurity #ThreatIntel #cve202628302 #critical #cve
Post summary
The post announces Microsoft’s Patch Tuesday update that remediates a critical remote code execution vulnerability (CVE‑2026‑28302) without mentioning any active exploitation or proof‑of‑concept.
0000046
19 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	solarwinds	serv-u	-	-	-

Explore more

Back to dashboard solarwinds CVEs serv-u vulnerabilities

What researchers are saying

CVE-2026-28302

GovCERT.CZ[verified]@GOVCERT_CZPatch

The post highlights critical RCE vulnerabilities in SolarWinds Serv‑U and urges users to apply the latest patch, Serv‑U 2026.3, to mitigate the risk.

Orizon[verified]@OrizonCyberPatch

The tweet announces a critical IDOR vulnerability in SolarWinds Serv-U (CVE-2026-28302) with a CVSS score of 9.1/10 and urges immediate patching.

TECHEPAGES[verified]@techepagesPatch

The SolarWinds Serv‑U 2026.3 advisory details 15 critical vulnerabilities—14 with CVSS 9.1 enabling root privilege escalation via RCE, plus a medium stored XSS—and confirms that patches are available.

Xavier Rivera[verified]@XavierRiveraXDisclosure

SolarWinds Serv‑U is affected by a critical IDOR flaw (CVE‑2026‑28302) that allows group‑admin users to gain root code execution; the issue is fixed in Serv‑U 2026‑3.

Security Arsenal, LLC[verified]@SecurityAr58409Patch

The post announces Microsoft’s Patch Tuesday update that remediates a critical remote code execution vulnerability (CVE‑2026‑28302) without mentioning any active exploitation or proof‑of‑concept.

CERT-PY@CERTpyGeneral

The tweet merely lists three SolarWinds CVE identifiers and provides a link to additional information, without disclosing any technical details, PoC, patch, or exploitation evidence.