CVE-2026-28317

Katalog CVE

CVSS 9.1 · Critical EPSS 0,50%

Kerentanan Authorization Bypass Through User-Controlled Key pada solarwinds serv-u. Skor CVSS 3.1 9.1 (Critical) menurut solarwinds.com.

Deskripsi (NVD)

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation. This issue requires domain administrator access. The impact is lower in Windows deployments.

Rincian

Terbit di NVD

21 Juli 2026

Terakhir diubah

24 Juli 2026

Status NVD

Analyzed

CVSS 3.1

9.1 (Critical), sumber solarwinds.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-639: Authorization Bypass Through User-Controlled Key

EPSS (30 hari)

0,50% peluang dieksploitasi; lebih tinggi dari 40,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_2026-3_release_notes.... release notes · advisory vendor
• https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28317 advisory vendor