CVE-2026-28314Patch(solarwinds / serv-u)

LOWCVSS 9.1 · CRITICAL

Signal is active with 2 mentions in latest observed window

Immediate actions

Patch solarwinds serv-u systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

SolarWinds Serv-U is affected by an insecure direct object reference vulnerability that leads to an account takeover. User authentication is required. The impact is lower in Windows deployments.

solarwinds CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

Weakness type (CWE)

CWE-639

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

serv-u

Threat summary

Patch or workaround signal is available
4 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 4 signals
Disclosure: 1 classified signal
General: 1 classified signal
Peaked 1d ago at 2 mentions (2026-07-21); latest day: 2
4 total mentions across 2 days

Affected systems

Vendors

solarwinds

Products

serv-u

Deep dive

Activity timeline4 mentions / 2d

Signal classification3 categories

Patch

250.0%

Disclosure

125.0%

General

125.0%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-21	2	Disclosure1General1
2026-07-22	2	Patch2

Full discourse4 posts

FOFA@fofabot91d
Patch
⚠️⚠️ CVE-2026-28304 (CVSS 9.1) + CVE-2026-28314 (CVSS 9.1): SolarWinds Serv-U patch wave — authenticated IDOR/priv-esc paths to root RCE; CVE-2026-28314 needs only user auth for account takeover (≤15.5.4 HF1; fix Serv-U 2026.3). 🔗FOFA Link: https://en.fofa.info/result?qbase64=YXBwPSJTb2xhcldpbmRzLVNlcnYtVS1GVFAi 🎯91.3K+ Results are found on http://en.fofa.info in the past year. FOFA Query: app="SolarWinds-Serv-U-FTP" 🔖Refer: https://securityonline.info/solarwinds-serv-u-vulnerabilities/ #OSINT #FOFA #CyberSecurity #Vulnerability
Post summary
The post announces two high‑severity SolarWinds Serv‑U CVEs (CVE‑2026‑28304 and CVE‑2026‑28314), details their IDOR/priv‑esc and RCE nature, links to FOFA search results, and confirms that a patch (Serv‑U 2026.3) is available.
0602292.5K
14.7K followersView on X
TECHEPAGES@techepages91d
Patch
SolarWinds Serv-U 2026.3 patches 15 vulnerabilities — 14 Critical (CVSS 9.1) enabling privilege escalation to root RCE. List of all vulnerabilities reported in the latest security advisory: 🔵 CVE-2026-28302 🔵 CVE-2026-28304 🔵 CVE-2026-28305 🔵 CVE-2026-28306 🔵 CVE-2026-28307 🔵 CVE-2026-28308 🔵 CVE-2026-28309 🔵 CVE-2026-28310 🔵 CVE-2026-28311 🔵 CVE-2026-28312 🔵 CVE-2026-28313 🔵 CVE-2026-28314 🔵 CVE-2026-28315 (Medium — stored XSS) 🔵 CVE-2026-28316 🔵 CVE-2026-28317 🔵 CVE-2026-28321
Post summary
SolarWinds Serv-U 2026.3 publishes a patch for 15 critical vulnerabilities, including a CVSS 9.1 RCE and a stored XSS, but no exploitation or PoC details are provided.
0000041
31 followersView on X
Infoflowcloud@infoflowcloud91d
Disclosure
🚨*CVE* CVE-2026-28314 SolarWinds Serv-U is affected by an insecure direct object reference vulnerability that leads to an account takeover. User authentication is required. The impact is l… https://www.cve.org/CVERecord?id=CVE-2026-28314 ----- Traducción: CVE-2026-28314 Sol… http://infoflow.cloud`
Post summary
The tweet announces CVE-2026-28314 for SolarWinds Serv‑U, describing an IDOR vulnerability that enables account takeover after authentication, but it provides no PoC, exploit, patch, or active exploitation evidence.
0000030
102 followersView on X
CVE@CVEnew91d
General
CVE-2026-28314 SolarWinds Serv-U is affected by an insecure direct object reference vulnerability that leads to an account takeover. User authentication is required. The impact is l… https://www.cve.org/CVERecord?id=CVE-2026-28314
Post summary
The excerpt discusses CVE‑2026‑28314 as an insecure direct object reference in SolarWinds Serv‑U that enables account takeover, but it offers no PoC, exploit code, or patch information.
00000775
57.8K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	solarwinds	serv-u	-	-	-

Explore more

Back to dashboard solarwinds CVEs serv-u vulnerabilities

What researchers are saying

CVE-2026-28314

FOFA[verified]@fofabotPatch

The post announces two high‑severity SolarWinds Serv‑U CVEs (CVE‑2026‑28304 and CVE‑2026‑28314), details their IDOR/priv‑esc and RCE nature, links to FOFA search results, and confirms that a patch (Serv‑U 2026.3) is available.

TECHEPAGES[verified]@techepagesPatch

SolarWinds Serv-U 2026.3 publishes a patch for 15 critical vulnerabilities, including a CVSS 9.1 RCE and a stored XSS, but no exploitation or PoC details are provided.

Infoflowcloud@infoflowcloudDisclosure

The tweet announces CVE-2026-28314 for SolarWinds Serv‑U, describing an IDOR vulnerability that enables account takeover after authentication, but it provides no PoC, exploit, patch, or active exploitation evidence.

CVE@CVEnewGeneral

The excerpt discusses CVE‑2026‑28314 as an insecure direct object reference in SolarWinds Serv‑U that enables account takeover, but it offers no PoC, exploit code, or patch information.