What is CVE-2026-28304?

CVE-2026-28304 is a critical-severity vulnerability in Solarwinds Serv-u, classified under Improper Access Control. CVSS score: 9.1/10. Published 2026-07-21.

How severe is CVE-2026-28304?

Critical severity. CVSS v3 base score is 9.1 out of 10.

Vulnerability in Solarwinds Serv-u

CVE-2026-28304

SolarWinds Serv-U is affected by a remote code execution vulnerability that, when exploited, can allow the arbitrary execution of code remotely as root. The impact is lower in Windows deployments.

CVSS v3 metric

CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.

Affected products

Solarwinds Serv-u — versions 15.5.4 HF1 and below

Weakness classification (CWE)

CWE-284 — Improper Access Control

References

psirt@solarwinds.com (vendor-advisory)
psirt@solarwinds.com

Frequently asked questions

What is CVE-2026-28304?: CVE-2026-28304 is a critical-severity vulnerability in Solarwinds Serv-u, classified under Improper Access Control. CVSS score: 9.1/10. Published 2026-07-21.
How severe is CVE-2026-28304?: Critical severity. CVSS v3 base score is 9.1 out of 10.