This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] SolarWinds Serv-U fixes multiple vulnerabilities
SolarWinds fixes 16 vulnerabilities in Serv-U version 2026.3. The most severe selected ones are described below; the others can be found at [1].
An authenticated remote attacker can execute code with root privileges [2].
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
More information:
- CVE-2026-28304 at cve.org, NVD
- CWE-284: Improper Access Control at cwe.mitre.org
The vulnerability was publicly disclosed 21. 7. 2026.
An authenticated remote attacker with domain administrator privileges can illegitimately elevate their privileges to system administrator level [3].
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
More information:
- CVE-2026-28306 at cve.org, NVD
- CWE-284: Improper Access Control at cwe.mitre.org
The vulnerability was publicly disclosed 21. 7. 2026.
An authenticated remote attacker can take over another user's account without authorization [4].
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
More information:
- CVE-2026-28314 at cve.org, NVD
- CWE-639: Authorization Bypass Through User-Controlled Key at cwe.mitre.org
The vulnerability was publicly disclosed 21. 7. 2026.
Links
- [1] https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_2026-3_release_notes.htm
- [2] https://www.solarwinds.com/trust-center/security-advisories/cve-2026-28304
- [3] https://www.solarwinds.com/trust-center/security-advisories/cve-2026-28306
- [4] https://www.solarwinds.com/trust-center/security-advisories/cve-2026-28314
By CESNET, z.s.p.o. Ondrej Pavlovič on 23. 7. 2026.