Loading vulnerability…
Account takeover IDOR in SolarWinds Serv-U
CVE-2026-28314 is an insecure direct object reference vulnerability in SolarWinds Serv-U affecting versions 15.5.4 HF1 and earlier on Windows and Linux. The flaw allows an authenticated user to access or manipulate objects without proper authorization checks, resulting in account takeover. The issue is classified as CWE-639. Available information indicates the vulnerability is network-reachable, requires no user interaction, and has lower impact on Windows deployments than on Linux deployments.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an authenticated attacker to take over another account within the affected Serv-U environment. Given the assigned severity and CVSS characteristics, compromise can result in unauthorized access to sensitive data and unauthorized actions in the context of the hijacked account, with potential downstream effects on confidentiality, integrity, and availability. The vendor notes that impact is lower on Windows deployments.
If you can’t patch tonight, do this now.
Apply the vendor security update as the primary mitigation. Until patching is completed, reduce exposure of Serv-U administrative and user-facing functionality to only trusted networks and users, review object-level authorization boundaries, and audit privileged and delegated account assignments to minimize the risk from authenticated misuse scenarios. Additional hardening of publicly accessible components and administrative access paths is advisable.
Patch, then assume compromise.
Upgrade SolarWinds Serv-U to version 2026.3 or later. Systems running Serv-U 15.5.4 HF1 and earlier should be updated to the vendor-fixed release referenced in the July 21, 2026 security updates and release notes.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.