Is CVE-2026-28312 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-28312 being exploited in the wild.

How severe is CVE-2026-28312?

Critical severity, with a CVSS score of 9.1, published 21 July 2026.

Which products and versions are affected?

SolarWinds Serv-U 15.5.4 HF1 and below.

Is there a fix for CVE-2026-28312?

A patch was published on 2026-07-21: Fixed in Serv-U version 2026.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-28312 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-28312?

Check whether you run SolarWinds Serv-U at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-28312: SolarWinds Serv-U privilege escalation in administrator group access

CVE-2026-28312 · Severity: critical · CVSS 9.1 · Published 2026-07-21

SolarWinds Serv-U, a managed file transfer and FTP server, is affected by a security flaw that allows users with existing group access to elevate their privileges to system administrator. On Linux-based systems, this allows an attacker to take full control of the server and execute commands with root-level authority, potentially leading to data theft or complete service disruption. While the impact is slightly lower on Windows deployments, the vulnerability still poses a significant risk to organizational data and infrastructure.

Technologies: SolarWinds Serv-U. Vendors: SolarWinds.

Quick answers

Is CVE-2026-28312 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-28312 being exploited in the wild.
How severe is CVE-2026-28312?: Critical severity, with a CVSS score of 9.1, published 21 July 2026.
Which products and versions are affected?: SolarWinds Serv-U 15.5.4 HF1 and below.
Is there a fix for CVE-2026-28312?: A patch was published on 2026-07-21: Fixed in Serv-U version 2026.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-28312 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-28312?: Check whether you run SolarWinds Serv-U at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A privilege escalation vulnerability exists in SolarWinds Serv-U due to improper authorization (CWE-285). An attacker with high-privileged credentials (such as group-level access) can exploit this flaw to elevate their permissions to system administrator. On Linux deployments, this leads to arbitrary code execution with root privileges; the impact is reported as lower on Windows systems but still critical. The vulnerability is reachable over the network without user interaction. SolarWinds has addressed this issue in Serv-U version 2026.3.

Affected products

SolarWinds Serv-U 15.5.4 HF1 and below

Timeline

2026-07-21: advisory: Initial advisory published by SolarWinds and NVD
2026-07-21: patched: Fixed in Serv-U version 2026.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.