CVE-2026-28316

CriticalCVSS 9.1/10Last modified Oct 24, 2026

Description

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation to a system administrator with the ability to execute commands as the root user. This issue requires a domain account with administrator access. The impact is lower in Windows deployments.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Jul 21, 2026
Last modified: Oct 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-283179.1SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation. This issue CVE-2026-283187.5SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encod CVE-2026-28325.3Certain Samsung MultiXpress Multifunction Printers may be vulnerable to information disclosure, potentially exposing address book entries an CVE-2026-283219.1SolarWinds Serv-U is affected by a broken access control vulnerability that could allow arbitrary file read and write, which can then be use CVE-2026-283225.6SolarWinds Database Performance Analyzer was found to be affected by a stored cross-site scripting vulnerability, which when exploited, can CVE-2026-283239.8SolarWinds Web Help Desk is found to be affected by a SAML authentication bypass vulnerability. This requires the SAML 2.0 authentication me CVE-2026-283249.8SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability due to the insuffici CVE-2026-283258.8SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability stemming from deseri CVE-2026-283268.8SolarWinds Access Rights Manager was reported to be affected by an unauthenticated remote code execution vulnerability. The issue stems from CVE-2026-283288.8SolarWinds Observability Self-Hosted was found to be affected by a broken authorization schema that can allow low-privileged users to access CVE-2026-283296.4SolarWinds Observability Self-Hosted was found to be affected by a Server-Side Request Forgery (SSRF) vulnerability that allows authenticate CVE-2026-28339.1An HTTP request smuggling vulnerability (CWE-444) was found in Pingora's handling of HTTP/1.1 connection upgrades. The issue occurs when a P