Is CVE-2026-28307 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-28307 being exploited in the wild.

How severe is CVE-2026-28307?

Critical severity, with a CVSS score of 9.1, published 21 July 2026.

Which products and versions are affected?

SolarWinds Serv-U 15.5.4 HF1 and below.

Is there a fix for CVE-2026-28307?

A patch was published on 2026-07-21: Fixed in Serv-U 2026.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-28307 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-28307?

Check whether you run SolarWinds Serv-U at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-28307: SolarWinds Serv-U privilege escalation in domain user groups

CVE-2026-28307 · Severity: critical · CVSS 9.1 · Published 2026-07-21

SolarWinds Serv-U, a managed file transfer and FTP server, is affected by a security flaw that allows certain users to gain unauthorized administrative control. An attacker with existing high-level permissions could exploit this to elevate a standard domain user group into a full administrator group. This could lead to a complete takeover of the file transfer service and unauthorized access to sensitive data stored on the server.

Technologies: SolarWinds Serv-U. Vendors: SolarWinds.

Quick answers

Is CVE-2026-28307 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-28307 being exploited in the wild.
How severe is CVE-2026-28307?: Critical severity, with a CVSS score of 9.1, published 21 July 2026.
Which products and versions are affected?: SolarWinds Serv-U 15.5.4 HF1 and below.
Is there a fix for CVE-2026-28307?: A patch was published on 2026-07-21: Fixed in Serv-U 2026.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-28307 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-28307?: Check whether you run SolarWinds Serv-U at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A privilege escalation vulnerability exists in SolarWinds Serv-U due to improper access control (CWE-284). The flaw allows an attacker with high-privileged credentials to elevate a domain user group to an administrator group, potentially leading to a full compromise of the Serv-U instance. The attack vector is network-based and requires high privileges but no user interaction. While the vulnerability affects multiple platforms, the vendor notes that the impact is lower in Windows-based deployments. The issue is resolved in Serv-U version 2026.3.

Affected products

SolarWinds Serv-U 15.5.4 HF1 and below

Timeline

2026-07-21: advisory: Initial advisory published by SolarWinds
2026-07-21: patched: Fixed in Serv-U 2026.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.