Is CVE-2026-28315 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-28315 being exploited in the wild.

How severe is CVE-2026-28315?

Medium severity, with a CVSS score of 6.2, published 21 July 2026.

Which products and versions are affected?

SolarWinds Serv-U 15.5.4 HF1 and below.

Is there a fix for CVE-2026-28315?

A patch was published on 2026-07-21: Fixed in version 2026.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-28315 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-28315?

Check whether you run SolarWinds Serv-U at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-28315: SolarWinds Serv-U stored XSS in administrator interface

CVE-2026-28315 · Severity: medium · CVSS 6.2 · Published 2026-07-21

SolarWinds Serv-U, a managed file transfer solution, is affected by a security flaw that could allow an attacker to inject malicious scripts into the application. If an administrator views the affected area, the attacker could hijack their session or steal sensitive information. This could lead to unauthorized access to the file transfer system and the data it manages.

Technologies: SolarWinds Serv-U. Vendors: SolarWinds.

Quick answers

Is CVE-2026-28315 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-28315 being exploited in the wild.
How severe is CVE-2026-28315?: Medium severity, with a CVSS score of 6.2, published 21 July 2026.
Which products and versions are affected?: SolarWinds Serv-U 15.5.4 HF1 and below.
Is there a fix for CVE-2026-28315?: A patch was published on 2026-07-21: Fixed in version 2026.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-28315 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-28315?: Check whether you run SolarWinds Serv-U at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in SolarWinds Serv-U versions 15.5.4 HF1 and below. The flaw (CWE-79) allows a remote attacker with high privileges to inject malicious scripts into the web interface. When an administrative user interacts with the compromised component, the script executes in their browser context, potentially leading to session hijacking or sensitive information disclosure. The vulnerability is addressed in Serv-U version 2026.3.

Affected products

SolarWinds Serv-U 15.5.4 HF1 and below

Timeline

2026-07-21: advisory
2026-07-21: disclosed
2026-07-21: patched: Fixed in version 2026.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.