CVE-2026-28309

Critical9.1Published on July 21, 2026

SolarWinds Serv-U is affected by a broken access control vulnerability that allows a domain administrator to create system administrator accounts. The impact is lower in Windows deployments.

CVSS score9.1 / 10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness type (CWE)CWE-862

Vendorssolarwinds

Affected products

Vendors	Product	Versions
solarwinds	serv-u	< 2026.3

Vulnerabilities

Exploited Cisco ISE Flaw Leads a Wave of Attacks on Trusted Software Channels

Active exploitation of a critical Cisco ISE flaw highlights attacks through trusted software channels, Orkes, Discourse, libheif and AI plugins.

Sep 21, 202617:436 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Affected products

Related articles

Exploited Cisco ISE Flaw Leads a Wave of Attacks on Trusted Software Channels