SolarWinds Serv-U file transfer software contains an insecure direct object reference (IDOR) vulnerability, rated CVSS 9.1 Critical, that can escalate an authenticated admin account into remote code execution as root.
What Is It
CVE-2026-28305 is an insecure direct object reference (IDOR) flaw (CWE-639) in SolarWinds Serv-U. According to SolarWinds' PSIRT, the vulnerability can lead to remote code execution as root. Exploitation requires a domain account with admin privileges and read/write access to the home directory. The impact is lower in Windows deployments than on Linux.
The CVSS 3.1 base score is 9.1 (Critical), with the vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, network-reachable, low attack complexity, high privileges required, no user interaction, and a changed scope with high confidentiality, integrity, and availability impact.
Why It Matters
Serv-U is a widely deployed managed file transfer product, and its history has made it a repeated target. A network-facing flaw that yields root-level code execution, crossing a privilege scope boundary, gives an attacker who already holds admin-level access full control of the underlying host. The elevated impact on Linux deployments makes those systems the priority for remediation.
What's Vulnerable
- Vendor/Product: SolarWinds Serv-U
- Affected versions: 15.5.4 HF1 and below
- Platforms: Windows and Linux (impact is lower on Windows)
Patch Status
The CVE record is currently in "Awaiting Analysis" status at NVD, published July 21, 2026. SolarWinds has issued a security advisory and 2026-3 release notes (linked below); administrators should consult those official sources for fixed-version and upgrade guidance. No CISA KEV entry was supplied with this record, so active exploitation is not confirmed in the available source material.