Is CVE-2026-28309 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-28309 being exploited in the wild.

How severe is CVE-2026-28309?

Critical severity, with a CVSS score of 9.1, published 21 July 2026.

Which products and versions are affected?

SolarWinds Serv-U 15.5.4 HF1 and below.

Is there a fix for CVE-2026-28309?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-28309 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-28309?

Check whether you run SolarWinds Serv-U at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-28309: SolarWinds Serv-U broken access control in administrator account creation

CVE-2026-28309 · Severity: critical · CVSS 9.1 · Published 2026-07-21

SolarWinds Serv-U, a managed file transfer and FTP server, is affected by a security flaw that allows users with domain administrator privileges to improperly create full system administrator accounts. This could allow a restricted administrator to gain complete control over the entire file transfer server and its underlying configuration. While the risk is present on both Windows and Linux, the impact is reported to be lower on Windows deployments.

Technologies: SolarWinds Serv-U. Vendors: SolarWinds.

Quick answers

Is CVE-2026-28309 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-28309 being exploited in the wild.
How severe is CVE-2026-28309?: Critical severity, with a CVSS score of 9.1, published 21 July 2026.
Which products and versions are affected?: SolarWinds Serv-U 15.5.4 HF1 and below.
Is there a fix for CVE-2026-28309?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-28309 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-28309?: Check whether you run SolarWinds Serv-U at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A broken access control vulnerability (CWE-862) exists in SolarWinds Serv-U versions 15.5.4 HF1 and below. The flaw allows an authenticated attacker with Domain Administrator privileges to bypass intended authorization restrictions and create System Administrator accounts, effectively escalating their privileges to the highest level within the application. The attack is reachable over the network without user interaction, though it requires high-level existing privileges (PR:H). The vulnerability has a higher impact on Linux deployments compared to Windows. SolarWinds has addressed this issue in Serv-U version 2026.3.

Affected products

SolarWinds Serv-U 15.5.4 HF1 and below

Timeline

2026-07-21: disclosed
2026-07-21: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.