Advisories · Technology

SolarWinds Serv-U.

Every CVE that names SolarWinds Serv-U among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-28321 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

SolarWinds Serv-U Broken Access Control Vulnerability
- SolarWinds Serv-U
- Broken access control
Not analysed yet 21 Jul 2026
CVE-2026-28317 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability
- SolarWinds Serv-U
- Broken access control
Not analysed yet 21 Jul 2026
CVE-2026-28316 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability
- SolarWinds Serv-U
- Broken access control
Not analysed yet 21 Jul 2026
CVE-2026-28315 CVE record

CVSS 6.2 Medium

SolarWinds Serv-U Authenticated Stored Cross-site Scripting (XSS) Vulnerability
- SolarWinds Serv-U
- Cross-site scripting (XSS)
Not analysed yet 21 Jul 2026
CVE-2026-28314 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability
- SolarWinds Serv-U
- Broken access control
Not analysed yet 21 Jul 2026
CVE-2026-28313 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability
- SolarWinds Serv-U
- Broken access control
Not analysed yet 21 Jul 2026
CVE-2026-28312 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

SolarWinds Serv-U Privilege Escalation Vulnerability
- SolarWinds Serv-U
- Broken access control
Not analysed yet 21 Jul 2026
CVE-2026-28310 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

SolarWinds Serv-U Privilege Escalation Vulnerability
- SolarWinds Serv-U
- Broken access control
Not analysed yet 21 Jul 2026
CVE-2026-28309 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

SolarWinds Serv-U Broken Access Control Vulnerability
- SolarWinds Serv-U
- Broken access control
Not analysed yet 21 Jul 2026
CVE-2026-28308 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability
- SolarWinds Serv-U
- Broken access control
Not analysed yet 21 Jul 2026
CVE-2026-28307 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

SolarWinds Serv-U Privilege Escalation Vulnerability
- SolarWinds Serv-U
- Broken access control
Not analysed yet 21 Jul 2026
CVE-2026-28306 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

SolarWinds Serv-U Privilege Escalation Vulnerability
- SolarWinds Serv-U
- Broken access control
Not analysed yet 21 Jul 2026
CVE-2026-28305 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability
- SolarWinds Serv-U
- Broken access control
Not analysed yet 21 Jul 2026
CVE-2026-28304 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

SolarWinds Serv-U Remote Code Execution Vulnerability
- SolarWinds Serv-U
- Broken access control
Not analysed yet 21 Jul 2026
CVE-2026-28302 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability
- SolarWinds Serv-U
- Broken access control
Not analysed yet 21 Jul 2026
CVE-2026-28318 CVE record

CVSS 7.5 HighCritical · KEV, CVSS 7+ and EPSSKEV

SolarWinds Serv-U Unauthenticated Denial of Service Vulnerability
- SolarWinds Serv-U
- Denial of service
Not analysed yet 4 Jun 2026
CVE-2025-40541 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Remote Code Execution Vulnerability
- SolarWinds Serv-U
- CWE-704
Not analysed yet 24 Feb 2026
CVE-2025-40540 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

SolarWinds Serv-U Type Confusion Remote Code Execution Vulnerability
- SolarWinds Serv-U
- CWE-704
Not analysed yet 24 Feb 2026
CVE-2025-40539 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

SolarWinds Serv-U Type Confusion Remote Code Execution Vulnerability
- SolarWinds Serv-U
- CWE-704
Not analysed yet 24 Feb 2026
CVE-2025-40538 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

SolarWinds Serv-U Broken Access Control Remote Code Execution Vulnerability
- SolarWinds Serv-U
- Privilege escalation
Not analysed yet 24 Feb 2026
CVE-2025-40549 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

SolarWinds Serv-U Path Restriction Bypass Vulnerability
- SolarWinds Serv-U
- Path traversal
Not analysed yet 18 Nov 2025
CVE-2025-40548 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

SolarWinds Serv-U Broken Access Control - Remote Code Execution Vulnerability
- SolarWinds Serv-U
- Privilege escalation
Not analysed yet 18 Nov 2025
CVE-2025-40547 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

SolarWinds Serv-U Logic Abuse - Remote Code Execution Vulnerability
- SolarWinds Serv-U
- CWE-116
Not analysed yet 18 Nov 2025
CVE-2024-45712 CVE record

CVSS 2.6 Low

SolarWinds Serv-U Client-Side Cross-Site Scripting Vulnerability
- SolarWinds Serv-U
- Cross-site scripting (XSS)
Not analysed yet 15 Apr 2025
CVE-2024-45711 CVE record

CVSS 7.5 High

SolarWinds Serv-U FTP Service Directory Traversal Remote Code Execution Vulnerability
- SolarWinds Serv-U
- Path traversal
Not analysed yet 16 Oct 2024
CVE-2024-45714 CVE record

CVSS 4.8 Medium

SolarWinds Serv-U Stored XSS Vulnerability
- SolarWinds Serv-U
- Cross-site scripting (XSS)
Not analysed yet 16 Oct 2024
CVE-2024-28995 CVE record

CVSS 8.6 HighCritical · KEV, CVSS 7+ and EPSSKEV

SolarWinds Serv-U L Directory Transversal Vulnerability
- SolarWinds Serv-U
- Path traversal
Not analysed yet 6 Jun 2024
CVE-2024-28072 CVE record

CVSS 5.7 Medium

Arbitrary File Overwrite Vulnerability
- SolarWinds Serv-U
- Information disclosure
Not analysed yet 3 May 2024
CVE-2023-40053 CVE record

CVSS 5.0 Medium

HTML injection Vulnerability in Serv-U 15.4
- SolarWinds Serv-U
- CWE-20
Not analysed yet 6 Dec 2023
CVE-2023-40060 CVE record

CVSS 7.2 High

2FA/MFA Bypass Vulnerability in Serv-U 15.4 and 15.4 Hotfix 1
- SolarWinds Serv-U
- Broken access control
Not analysed yet 7 Sept 2023
CVE-2023-35179 CVE record

CVSS 7.2 High

2FA/MFA Bypass Vulnerability in Serv-U 15.4
- SolarWinds Serv-U
- Broken access control
Not analysed yet 10 Aug 2023
CVE-2021-35249 CVE record

CVSS 4.3 Medium

Domain Admin Broken Access Control
- SolarWinds Serv-U
- Broken access control
Not analysed yet 17 May 2022
CVE-2021-35250 CVE record

CVSS 7.5 HighCritical · CVSS 7+ and EPSS

Directory Transversal Vulnerability in Serv-U 15.3
- SolarWinds Serv-U
- Path traversal
Not analysed yet 25 Apr 2022
CVE-2021-35247 CVE record

CVSS 4.3 MediumCritical · KEVKEV

Improper Input Validation Vulnerability in Serv-U
- SolarWinds Serv-U
- CWE-20
Not analysed yet 7 Jan 2022
CVE-2021-35223 CVE record

CVSS 8.5 High

Execute Command Function Allows Remote Code Execution (RCE)Vulnerability
- SolarWinds Serv-U
- CWE-20
Not analysed yet 31 Aug 2021