CVE-2026-28316

Publié : 21 juillet 2026

Modifié : 21 juillet 2026

Score CVSS

9.1

CRITICAL

Description détaillée

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation to a system administrator with the ability to execute commands as the root user. This issue requires a domain account with administrator access. The impact is lower in Windows deployments.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Références et Patchs

https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_2026-3_release_notes.htm https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28316

Dernières Vulnérabilités

CVE-2026-64798

Persistent URL login keys were also generated using a non-cryptographic random generator with insufficient entropy.

VOIR DÉTAILS

CVE-2026-64797

IP Login trusted forwarded client-IP headers without requiring a configured trusted proxy. Attackers could spoof the IP used for automatic login and potentially impersonate mapped accounts.

VOIR DÉTAILS

CVE-2026-64796

Free did not require both the article creator and last modifier to be Super Users before executing article PHP. Pro did not consistently enforce configured CSS, JavaScript and PHP permissions across tags, attributes, files and both article owners. PHP include attributes could also escape the configured include folder, and executable script/style variants could bypass detection.

VOIR DÉTAILS