Solarwinds Serv-U
55 CVEs affecting Solarwinds Serv-U. Latest disclosed: 2026-07-21. Critical: 23, High: 17.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-35481 | Critical | 9.8 | 2021-02-03 | SolarWinds Serv-U before 15.2.2 allows Unauthenticated Macro Injection. |
CVE-2026-28321 | Critical | 9.1 | 2026-07-21 | SolarWinds Serv-U is affected by a broken access control vulnerability that could allow arbitrary file read and write, which can then be used to escalate privi… |
CVE-2026-28317 | Critical | 9.1 | 2026-07-21 | SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation. This issue requires domain adm… |
CVE-2026-28316 | Critical | 9.1 | 2026-07-21 | SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation to a system administrator with… |
CVE-2026-28314 | Critical | 9.1 | 2026-07-21 | SolarWinds Serv-U is affected by an insecure direct object reference vulnerability that leads to an account takeover. User authentication is required. The impa… |
CVE-2026-28313 | Critical | 9.1 | 2026-07-21 | SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to SMTP hijacking leading to arbitrary account takeover… |
CVE-2026-28312 | Critical | 9.1 | 2026-07-21 | SolarWinds Serv-U is affected by a privilege escalation vulnerability. This would elevate a group’s access to system administrator and allow code execution as… |
CVE-2026-28310 | Critical | 9.1 | 2026-07-21 | SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to escalate their user type to that of a system admini… |
CVE-2026-28309 | Critical | 9.1 | 2026-07-21 | SolarWinds Serv-U is affected by a broken access control vulnerability that allows a domain administrator to create system administrator accounts. The impact i… |
CVE-2026-28308 | Critical | 9.1 | 2026-07-21 | SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution. Domain administrator access i… |
CVE-2026-28307 | Critical | 9.1 | 2026-07-21 | SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain user group to be elevated into an administrator group. The impact is… |
CVE-2026-28306 | Critical | 9.1 | 2026-07-21 | SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to elevate their privileges to a system administrator… |
CVE-2026-28305 | Critical | 9.1 | 2026-07-21 | SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution as root. A domain account with… |
CVE-2026-28304 | Critical | 9.1 | 2026-07-21 | SolarWinds Serv-U is affected by a remote code execution vulnerability that, when exploited, can allow the arbitrary execution of code remotely as root. The im… |
CVE-2026-28302 | Critical | 9.1 | 2026-07-21 | SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation and remote code execution as ro… |
CVE-2025-40541 | Critical | 9.1 | 2026-02-24 | An Insecure Direct Object Reference (IDOR) vulnerability exists in Serv-U, which when exploited, gives a malicious actor the ability to execute native code as… |
CVE-2025-40540 | Critical | 9.1 | 2026-02-24 | A type confusion vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to execute arbitrary native code as privileged accoun… |
CVE-2025-40539 | Critical | 9.1 | 2026-02-24 | A type confusion vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to execute arbitrary native code as privileged accoun… |
CVE-2025-40538 | Critical | 9.1 | 2026-02-24 | A broken access control vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to create a system admin user and execute arbi… |
CVE-2025-40549 | Critical | 9.1 | 2025-11-18 | A Path Restriction Bypass vulnerability exists in Serv-U that when abused, could give a malicious actor with access to admin privileges the ability to execute… |