SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability (CVE-2026-28317)
Summary
SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation. This issue requires domain administrator access. The impact is lower in Windows deployments.
Affected Products
SolarWinds Serv-U 15.5.4 HF1 and below
Fixed Software Release
Acknowledgments
Intigriti Bug Bounty Program
Advisory Details
Severity
9.1 Critical
Advisory ID
First Published
07/21/2026
Fixed Version