CVE-2026-28316: fallo crítico en SolarWinds Serv-U
SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.1epss 2.1%
SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation to a system administrator with the ability to execute commands as the root user. This issue requires a domain account with administrator access. The impact is lower in Windows deployments.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Productos afectados
SolarWinds · Serv-UCVEs relacionadas — SolarWinds Serv-U
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-28318HIGHSolarWinds Serv-U Unauthenticated Denial of Service VulnerabilityEPSS 43.7%KEVCVE-2021-35247MEDIUMImproper Input Validation Vulnerability in Serv-UEPSS 3.7%KEVCVE-2021-35250HIGHDirectory Transversal Vulnerability in Serv-U 15.3EPSS 12.8%CVE-2024-45711HIGHSolarWinds Serv-U FTP Service Directory Traversal Remote Code Execution VulnerabilityEPSS 6.3%CVE-2021-35223HIGHExecute Command Function Allows Remote Code Execution (RCE)VulnerabilityEPSS 2.9%CVE-2025-40549CRITICALSolarWinds Serv-U Path Restriction Bypass VulnerabilityEPSS 1.1%