CVE-2026-28305

Critical9.1Published on July 21, 2026

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution as root. A domain account with admin privileges and read and write access to the home directory is required. The impact is lower in Windows deployments.

CVSS score9.1 / 10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness type (CWE)CWE-639

Vendorssolarwinds

Affected products

Vendors	Product	Versions
solarwinds	serv-u	< 2026.3

Vulnerabilities

Exploited Cisco ISE Flaw Leads a Wave of Attacks on Trusted Software Channels

Active exploitation of a critical Cisco ISE flaw highlights attacks through trusted software channels, Orkes, Discourse, libheif and AI plugins.

Sep 21, 202617:436 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Affected products

Related articles

Exploited Cisco ISE Flaw Leads a Wave of Attacks on Trusted Software Channels