CVE-2026-28302

Critical9.1Published on July 21, 2026

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation and remote code execution as root. This issue requires group administrator access. The impact is lower in Windows deployments.

CVSS score9.1 / 10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness type (CWE)CWE-639

Vendorssolarwinds

Affected products

Vendors	Product	Versions
solarwinds	serv-u	< 2026.3

Vulnerabilities

Exploited Cisco ISE Flaw Leads a Wave of Attacks on Trusted Software Channels

Active exploitation of a critical Cisco ISE flaw highlights attacks through trusted software channels, Orkes, Discourse, libheif and AI plugins.

Sep 21, 202617:436 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Affected products

Related articles

Exploited Cisco ISE Flaw Leads a Wave of Attacks on Trusted Software Channels