Loading vulnerability…
IDOR in SolarWinds Serv-U leading to SMTP hijacking and account takeover
CVE-2026-28313 is an insecure direct object reference vulnerability in SolarWinds Serv-U affecting version 15.5.4 HF1 and earlier on Windows and Linux. The flaw allows improper access to object references within Serv-U in a way that can be abused to manipulate SMTP-related functionality. Successful exploitation can result in SMTP hijacking and arbitrary takeover of user accounts. Available reporting indicates the issue is network-reachable, requires no user interaction, and occurs in the context of an authenticated attacker with elevated privileges. The impact is noted as lower on Windows deployments than on Linux deployments.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can allow an attacker to hijack SMTP functionality and take over arbitrary accounts within the affected Serv-U environment. This can lead to unauthorized access to user data and administrative capabilities associated with compromised accounts, with resulting loss of confidentiality and integrity. The published severity information also indicates high impact across confidentiality, integrity, and availability, although the specific described outcome for this CVE is account compromise via SMTP manipulation. Impact is reported to be lower on Windows deployments.
If you can’t patch tonight, do this now.
Apply the vendor update as the primary mitigation. Until patching is completed, reduce exposure of administrative and SMTP-related functionality, review and minimize privileged account assignments, and audit Serv-U permission structures for unnecessary high-privilege access. Because exploitation is reported to require authenticated elevated privileges, enforcing least privilege and restricting access to administrative interfaces can reduce risk. Additional hardening of publicly accessible Serv-U components is advisable.
Patch, then assume compromise.
Upgrade SolarWinds Serv-U to the vendor-fixed release, specifically Serv-U 2026.3 or later, as referenced in the July 21, 2026 security updates. Organizations running Serv-U 15.5.4 HF1 or earlier on Windows or Linux should prioritize patching because older versions are approaching end of life and may no longer receive security fixes.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.