CVE-2026-28305

Name of the Vulnerable Software and Affected Versions SolarWinds Serv-U (affected versions not specified)

Description SolarWinds Serv-U contains an insecure direct object reference (IDOR) flaw, which occurs when an application provides direct access to objects based on user-supplied input. This issue can lead to remote code execution with root privileges. Exploitation requires a domain account with admin privileges and read and write access to the home directory. The impact is reduced in Windows deployments.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.