CVE-2026-28309Disclosure(solarwinds / serv-u)

LOWCVSS 9.1 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch solarwinds serv-u systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

SolarWinds Serv-U is affected by a broken access control vulnerability that allows a domain administrator to create system administrator accounts. The impact is lower in Windows deployments.

solarwinds CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

Weakness type (CWE)

CWE-862

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

serv-u

Threat summary

Patch or workaround signal is available
4 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 3 signals
Disclosure: 2 classified signals
General: 1 classified signal
Peaked 2d ago at 2 mentions (2026-07-21); latest day: 1
4 total mentions across 3 days

Affected systems

Vendors

solarwinds

Products

serv-u

Deep dive

Activity timeline4 mentions / 3d

Signal classification3 categories

Disclosure

250.0%

Patch

125.0%

General

125.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-21	2	Disclosure2
2026-07-22	1	Patch1
2026-07-30	1	General1

Full discourse4 posts

ケイ | IT・セキュリティ系副業Webライター@Teeeda_worker82d
General
【緊急】CVE-2026-28309 SolarWinds Serv-Uに深刻な脆弱性｜即時対応が必要 https://www.cybernote.click/2026/07/29/cve-2026-28309-solarwinds-serv-u/ #IT #Security #cybersecurity
Post summary
The post alerts about an urgent CVE in SolarWinds Serv-U but offers no technical details or mitigation steps.
0000041
210 followersView on X
TECHEPAGES@techepages91d
Patch
SolarWinds Serv-U 2026.3 patches 15 vulnerabilities — 14 Critical (CVSS 9.1) enabling privilege escalation to root RCE. List of all vulnerabilities reported in the latest security advisory: 🔵 CVE-2026-28302 🔵 CVE-2026-28304 🔵 CVE-2026-28305 🔵 CVE-2026-28306 🔵 CVE-2026-28307 🔵 CVE-2026-28308 🔵 CVE-2026-28309 🔵 CVE-2026-28310 🔵 CVE-2026-28311 🔵 CVE-2026-28312 🔵 CVE-2026-28313 🔵 CVE-2026-28314 🔵 CVE-2026-28315 (Medium — stored XSS) 🔵 CVE-2026-28316 🔵 CVE-2026-28317 🔵 CVE-2026-28321
Post summary
The advisory announces that SolarWinds Serv-U 2026.3 has been updated to fix 15 vulnerabilities, 14 of which are critical with a CVSS score of 9.1, including a root privilege escalation RCE.
0000041
31 followersView on X
Infoflowcloud@infoflowcloud91d
Disclosure
🚨*CVE* CVE-2026-28309 SolarWinds Serv-U is affected by a broken access control vulnerability that allows a domain administrator to create system administrator accounts. The impact is lower… https://www.cve.org/CVERecord?id=CVE-2026-28309 ----- Traducción: CVE-2026-28309 Sol… http://infoflow.cloud`
Post summary
The tweet announces CVE‑2026‑28309, a broken access control flaw in SolarWinds Serv‑U that lets a domain administrator create system administrator accounts, and notes lower impact; no PoC, exploit, or patch information is provided.
0000029
94 followersView on X
CVE@CVEnew91d
Disclosure
CVE-2026-28309 SolarWinds Serv-U is affected by a broken access control vulnerability that allows a domain administrator to create system administrator accounts. The impact is lower… https://www.cve.org/CVERecord?id=CVE-2026-28309
Post summary
Announces SolarWinds Serv-U CVE‑2026‑28309, a broken access control flaw letting domain admins create system admin accounts, noted as having lower impact.
000001.6K
57.8K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	solarwinds	serv-u	-	-	-

Explore more

Back to dashboard solarwinds CVEs serv-u vulnerabilities

What researchers are saying

CVE-2026-28309

TECHEPAGES[verified]@techepagesPatch

The advisory announces that SolarWinds Serv-U 2026.3 has been updated to fix 15 vulnerabilities, 14 of which are critical with a CVSS score of 9.1, including a root privilege escalation RCE.

ケイ | IT・セキュリティ系副業Webライター@Teeeda_workerGeneral

The post alerts about an urgent CVE in SolarWinds Serv-U but offers no technical details or mitigation steps.

Infoflowcloud@infoflowcloudDisclosure

The tweet announces CVE‑2026‑28309, a broken access control flaw in SolarWinds Serv‑U that lets a domain administrator create system administrator accounts, and notes lower impact; no PoC, exploit, or patch information is provided.

CVE@CVEnewDisclosure

Announces SolarWinds Serv-U CVE‑2026‑28309, a broken access control flaw letting domain admins create system admin accounts, noted as having lower impact.