NCSC-2026-0265 [1.00] [M/H] Vulnerabilities fixed in SolarWinds Serv-U
SolarWinds has fixed multiple vulnerabilities in Serv-U. The vulnerabilities in SolarWinds Serv-U mainly involve insecure direct object reference (IDOR) and broken access control. These allow attackers with certain privileges, such as domain administrator or group administrator access, to escalate privileges to system administrator or root level. This enables them to execute arbitrary code remotely and gain system administration rights. Some vulnerabilities also allow for the hijacking of SMTP sessions, account takeovers, or persistent cross-site scripting (XSS) that can compromise administrator sessions. The impact of these vulnerabilities is generally less severe on Windows environments than on other platforms. Exploitation usually requires the attacker to already have authenticated access with high privileges, such as domain administrator rights. The fixed vulnerabilities predominantly concern those that can be exploited in so-called 'Evil Admin' scenarios. Such vulnerabilities are typically not easily exploited by unauthenticated malicious actors remotely. However, there are so many vulnerabilities fixed in these updates that it is advisable, in addition to deploying the updates, to check how the rights structure is implemented. This is especially true for components that are publicly accessible.
CSIRTS triage
- What
- Multiple vulnerabilities in SolarWinds Serv-U allow for privilege escalation and remote code execution.
- Who is affected
- Users with high privileges, such as domain or group administrators, on SolarWinds Serv-U.
- Urgency
- Remediation is medium urgency as exploitation requires high privileges, but the impact can be severe.
- Action
- Update to the latest version of Serv-U to mitigate these vulnerabilities.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Serv-U
Get an email when a new Serv-U advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://advisories.ncsc.nl/advisory?id=NCSC-2026-0265
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-283020.56% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 43% of all scored CVEs.
- Low exploitation riskCVE-2026-283040.55% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 43% of all scored CVEs.
- Low exploitation riskCVE-2026-283050.55% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 43% of all scored CVEs.
- Low exploitation riskCVE-2026-283060.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 27% of all scored CVEs.
- Low exploitation riskCVE-2026-283070.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 27% of all scored CVEs.
- Low exploitation riskCVE-2026-283080.55% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 43% of all scored CVEs.
- Low exploitation riskCVE-2026-283090.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 27% of all scored CVEs.
- Low exploitation riskCVE-2026-283100.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 27% of all scored CVEs.
- Low exploitation riskCVE-2026-283120.40% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 33% of all scored CVEs.
- Low exploitation riskCVE-2026-283130.34% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 27% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-28302 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-28304 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-28305 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-28306 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-28307 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-28308 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-28309 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-28310 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-28312 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-28313 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-28314 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-28315 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-28316 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-28317 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-28321 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- high[NEW] [high] SolarWinds Serv-U: Multiple vulnerabilitiescert-bund
- criticalCVE-2026-28321: SolarWinds Serv-U is affected by a broken access control vulnerability that could allow arbitr…nvd
- criticalCVE-2026-28317: SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that…nvd
- criticalCVE-2026-28316: SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that…nvd
- mediumCVE-2026-28315: SolarWinds Serv-U was found to be affected by a stored cross-site scripting vulnerability that…nvd
- criticalCVE-2026-28314: SolarWinds Serv-U is affected by an insecure direct object reference vulnerability that leads …nvd
- criticalCVE-2026-28313: SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that…nvd
- criticalCVE-2026-28312: SolarWinds Serv-U is affected by a privilege escalation vulnerability. This would elevate a gr…nvd
- criticalCVE-2026-28310: SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain adm…nvd
- criticalCVE-2026-28309: SolarWinds Serv-U is affected by a broken access control vulnerability that allows a domain ad…nvd
- criticalCVE-2026-28308: SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that…nvd
- criticalCVE-2026-28307: SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain use…nvd
Recent advisories for SolarWinds Serv-U
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- high[NEW] [high] SolarWinds Serv-U: Multiple vulnerabilitiescert-bund · 2026-07-22
- criticalCVE-2026-28321: SolarWinds Serv-U is affected by a broken access control vulnerability that could allow arbitr…nvd · 2026-07-21
- criticalCVE-2026-28317: SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that…nvd · 2026-07-21
- criticalCVE-2026-28316: SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that…nvd · 2026-07-21
- mediumCVE-2026-28315: SolarWinds Serv-U was found to be affected by a stored cross-site scripting vulnerability that…nvd · 2026-07-21
- criticalCVE-2026-28314: SolarWinds Serv-U is affected by an insecure direct object reference vulnerability that leads …nvd · 2026-07-21
More from NCSC-NL Advisories
- unknownNCSC-2026-0274 [1.00] [M/H] Kwetsbaarheid verholpen in SolarWinds Web Help Desk2026-07-31
- unknownNCSC-2026-0273 [1.00] [M/H] Kwetsbaarheden verholpen in Adobe Campaign Classic2026-07-31
- unknownNCSC-2026-0272 [1.00] [M/H] Kwetsbaarheden verholpen in JFrog Artifactory2026-07-31
- unknownNCSC-2026-0271 [1.00] [M/H] Vulnerability fixed in Cisco Secure Firewall Management Center2026-07-30
- unknownNCSC-2026-0270 [1.00] [M/M] Vulnerabilities fixed in GitLab by GitLab Inc.2026-07-30