CVE-2026-28313

CRITICAL 9.1CVE-2026-28313 · Published 21/07/2026 · updated 24/10/2026

Package	Affected versions	Patched versions
serv-u solarwinds	`< 2026.3`	`2026.3`

Description

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to SMTP hijacking leading to arbitrary account takeover. The impact is lower in Windows deployments.

References

documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_2026-3_release_notes.htm · Release Notes
https//www.solarwinds.com/trust-center/security-advisories/CVE-2026-28313 · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free