PatchTheCVEserv-u vulnerabilities and fixes
Recent CVEs affecting serv-u, with upgrade or downgrade steps. 15 tracked.
Also searched as: serv u.
serv-u has 15 tracked vulnerabilities, 14 critical. A fixed release or vendor patch exists for 15. Most recent: 2026-07-21. Highest priority: CVE-2026-28316 (score 52/100).
- CVE-2026-28316 CRITICAL 9.1 UPGRADE SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to pri
- CVE-2026-28302 CRITICAL 9.1 UPGRADE SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to pri
- CVE-2026-28304 CRITICAL 9.1 UPGRADE SolarWinds Serv-U is affected by a remote code execution vulnerability that, when exploited, can allow the arb
- CVE-2026-28305 CRITICAL 9.1 UPGRADE SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to rem
- CVE-2026-28308 CRITICAL 9.1 UPGRADE SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to rem
- CVE-2026-28312 CRITICAL 9.1 UPGRADE SolarWinds Serv-U is affected by a privilege escalation vulnerability
- CVE-2026-28314 CRITICAL 9.1 UPGRADE SolarWinds Serv-U is affected by an insecure direct object reference vulnerability that leads to an account ta
- CVE-2026-28321 CRITICAL 9.1 UPGRADE SolarWinds Serv-U is affected by a broken access control vulnerability that could allow arbitrary file read an
- CVE-2026-28306 CRITICAL 9.1 UPGRADE SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to el
- CVE-2026-28307 CRITICAL 9.1 UPGRADE SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain user group to be el
- CVE-2026-28309 CRITICAL 9.1 UPGRADE SolarWinds Serv-U is affected by a broken access control vulnerability that allows a domain administrator to c
- CVE-2026-28310 CRITICAL 9.1 UPGRADE SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to es
- CVE-2026-28313 CRITICAL 9.1 UPGRADE SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to SMT
- CVE-2026-28317 CRITICAL 9.1 UPGRADE SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to pri
- CVE-2026-28315 MEDIUM 6.2 UPGRADE SolarWinds Serv-U was found to be affected by a stored cross-site scripting vulnerability that could lead to s
FAQ
How do I fix serv-u vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is serv-u being exploited right now?
None of the tracked serv-u CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which serv-u CVE should I patch first?
CVE-2026-28316 currently ranks highest (52/100): SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to pri.