Loading vulnerability…
Privilege Escalation in SolarWinds Serv-U
CVE-2026-28310 is a missing authorization vulnerability in SolarWinds Serv-U 15.5.4 HF1 and earlier on Windows and Linux. An authenticated Serv-U domain administrator can escalate their user type to system administrator, crossing the application's administrative privilege boundary. Exploitation is network-accessible, has low complexity, and requires no user interaction. The vulnerability has a CVSS v3.1 score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). Its impact is lower on Windows deployments.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises the separation between domain-level and system-level administration in Serv-U, allowing a domain administrator to obtain broader administrative authority. The CVSS assessment indicates high confidentiality, integrity, and availability impacts with changed scope. Windows deployments have lower impact than Linux deployments; operating-system code execution is not specifically established for this CVE.
If you can’t patch tonight, do this now.
Until the update is deployed, review and minimize Serv-U domain administrator assignments and restrict network access to administrative functionality to trusted administrators and management networks. Review permission boundaries and publicly accessible administrative components. These measures reduce exposure but do not correct the authorization flaw.
Patch, then assume compromise.
Upgrade SolarWinds Serv-U to version 2026.3 or a later vendor-fixed release and apply the applicable security updates released on July 21, 2026.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.