CVE-2026-28312Patch(solarwinds / serv-u)

LOWCVSS 9.1 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch solarwinds serv-u systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

SolarWinds Serv-U is affected by a privilege escalation vulnerability. This would elevate a group’s access to system administrator and allow code execution as root. The impact is lower in Windows deployments.

solarwinds CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

Weakness type (CWE)

CWE-285

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

serv-u

Threat summary

Patch or workaround signal is available
4 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 4 signals
Disclosure: 1 classified signal
General: 1 classified signal
Peaked 1d ago at 3 mentions (2026-07-21); latest day: 1
4 total mentions across 2 days

Affected systems

Vendors

solarwinds

Products

serv-u

Deep dive

Activity timeline4 mentions / 2d

Signal classification3 categories

Patch

250.0%

Disclosure

125.0%

General

125.0%

Referenced assets2 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-21	3	Disclosure1General1Patch1
2026-07-22	1	Patch1

Full discourse4 posts

TECHEPAGES@techepages91d
Patch
SolarWinds Serv-U 2026.3 patches 15 vulnerabilities — 14 Critical (CVSS 9.1) enabling privilege escalation to root RCE. List of all vulnerabilities reported in the latest security advisory: 🔵 CVE-2026-28302 🔵 CVE-2026-28304 🔵 CVE-2026-28305 🔵 CVE-2026-28306 🔵 CVE-2026-28307 🔵 CVE-2026-28308 🔵 CVE-2026-28309 🔵 CVE-2026-28310 🔵 CVE-2026-28311 🔵 CVE-2026-28312 🔵 CVE-2026-28313 🔵 CVE-2026-28314 🔵 CVE-2026-28315 (Medium — stored XSS) 🔵 CVE-2026-28316 🔵 CVE-2026-28317 🔵 CVE-2026-28321
Post summary
SolarWinds Serv‑U 2026.3 has released patches for 15 critical vulnerabilities, most of which allow root RCE via privilege escalation, along with a medium‑severity stored XSS.
0000041
31 followersView on X
Upwind Security MDR@UpwindMDR91d
Patch
🚨 CRITICAL - SolarWinds Serv-U group privilege escalation to root (CVE-2026-28312) SolarWinds Serv-U contains a privilege escalation flaw in its privilege/group authorization handling that can elevate a user’s group access to system administrator and enable code execution as root. The root cause appears to be improper access control/authorization logic allowing unintended privilege assignment. An attacker with valid access to the Serv-U environment can abuse the group elevation path to gain admin-level capabilities and then execute commands with root privileges (impact is lower on Windows deployments). If exploited, this results in full system compromise on affected hosts, including remote code execution as root, takeover of managed files/services, and potential lateral movement. 👉 Affected: SolarWinds Serv-U 15.5.4 HF1 and below | Upgrade to a version newer than 15.5.4 HF1 (vendor-fixed release)
Post summary
SolarWinds Serv‑U versions 15.5.4 HF1 and earlier contain a critical privilege escalation flaw that can lead to root code execution—upgrade to a patched release newer than 15.5.4 HF1 to remediate.
0000096
255 followersView on X
Infoflowcloud@infoflowcloud91d
Disclosure
🚨*CVE* CVE-2026-28312 SolarWinds Serv-U is affected by a privilege escalation vulnerability. This would elevate a group’s access to system administrator and allow code execution as root. T… https://www.cve.org/CVERecord?id=CVE-2026-28312 ----- Traducción: CVE-2026-28312 Sol… http://infoflow.cloud`
Post summary
The message announces CVE‑2026‑28312 as a privilege‑escalation flaw in SolarWinds Serv‑U that can grant root code execution.
0000029
94 followersView on X
CVE@CVEnew91d
General
CVE-2026-28312 SolarWinds Serv-U is affected by a privilege escalation vulnerability. This would elevate a group’s access to system administrator and allow code execution as root. T… https://www.cve.org/CVERecord?id=CVE-2026-28312
Post summary
A concise disclosure of CVE-2026-28312 as a privilege escalation vulnerability that permits root execution, without any mention of PoC, exploit, patch, or active exploitation.
00000979
57.8K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	solarwinds	serv-u	-	-	-

Explore more

Back to dashboard solarwinds CVEs serv-u vulnerabilities

What researchers are saying

CVE-2026-28312

TECHEPAGES[verified]@techepagesPatch

SolarWinds Serv‑U 2026.3 has released patches for 15 critical vulnerabilities, most of which allow root RCE via privilege escalation, along with a medium‑severity stored XSS.

Upwind Security MDR[verified]@UpwindMDRPatch

SolarWinds Serv‑U versions 15.5.4 HF1 and earlier contain a critical privilege escalation flaw that can lead to root code execution—upgrade to a patched release newer than 15.5.4 HF1 to remediate.

Infoflowcloud@infoflowcloudDisclosure

The message announces CVE‑2026‑28312 as a privilege‑escalation flaw in SolarWinds Serv‑U that can grant root code execution.

CVE@CVEnewGeneral

A concise disclosure of CVE-2026-28312 as a privilege escalation vulnerability that permits root execution, without any mention of PoC, exploit, patch, or active exploitation.