Is CVE-2026-28313 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-28313 being exploited in the wild.

How severe is CVE-2026-28313?

Critical severity, with a CVSS score of 9.1, published 21 July 2026.

Which products and versions are affected?

SolarWinds Serv-U 15.5.4 HF1 and below.

Is there a fix for CVE-2026-28313?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-28313 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-28313?

Check whether you run SolarWinds Serv-U at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-28313: SolarWinds Serv-U IDOR and SMTP Hijacking

CVE-2026-28313 · Severity: critical · CVSS 9.1 · Published 2026-07-21

SolarWinds Serv-U, a managed file transfer and FTP server, is affected by a security flaw that allows for account takeover. An attacker can exploit this vulnerability to hijack the system's email notification settings, potentially leading to the compromise of user accounts and sensitive data. While the risk is present on all platforms, the impact is reportedly lower for organizations running the software on Windows.

Technologies: SolarWinds Serv-U. Vendors: SolarWinds.

Quick answers

Is CVE-2026-28313 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-28313 being exploited in the wild.
How severe is CVE-2026-28313?: Critical severity, with a CVSS score of 9.1, published 21 July 2026.
Which products and versions are affected?: SolarWinds Serv-U 15.5.4 HF1 and below.
Is there a fix for CVE-2026-28313?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-28313 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-28313?: Check whether you run SolarWinds Serv-U at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An Insecure Direct Object Reference (IDOR) vulnerability (CWE-639) exists in SolarWinds Serv-U versions 15.5.4 HF1 and below. The flaw allows an authenticated attacker with high privileges to manipulate object references to hijack SMTP configurations. This can be leveraged to facilitate arbitrary account takeovers across the platform. The vulnerability is reachable over the network without user interaction, though it requires high-level administrative privileges to execute. SolarWinds has addressed this issue in version 2026.3.

Affected products

SolarWinds Serv-U 15.5.4 HF1 and below

Timeline

2026-07-21: disclosed
2026-07-21: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.