The Circuitry
THE CIRCUITRYYour one-stop source for all tech news
HOMETODAYNEWSFEEDEVENTS
BOOKMARKS
RSS
© 2026 The Circuitry
About UsSourcesContactCorrectionsPrivacy
  • Today
  • Feed
  • Events
  • Saved
Scroll for more
Verification
VERIFIEDConfidence: HIGH
Source identified
Claims cross-referenced
No discrepancies found
Fact-check summary

SolarWinds disclosed CVE-2026-28302 (CVSS 9.1 IDOR leading to RCE as root) in Serv-U 2026.3 release notes on July 21, 2026; NVD added the record the same day.

Sourcing
1source

via NVD

NVD · track record
19Stories
100%Verified
330d
All sources →
From The CircuitryWhy The Circuitry

Verified tech news, cross-checked.

Every story is checked against independent sources before it posts — no rumors dressed up as fact.

How we verify →
Home/Tech/SolarWinds Serv-U Hit by Critical IDOR Flaw CVE-2026-28302
VERIFIEDBy Xavier Rivera· ·1 min read

SolarWinds Serv-U Hit by Critical IDOR Flaw CVE-2026-28302

SolarWinds Serv-U is affected by an IDOR vulnerability rated CVSS 9.1 that can lead to privilege escalation and remote code execution as root when group administrator access is available. The flaw, published July 21 2026, carries lower impact on Windows and is addressed in the Serv-U 2026-3 release.

Source:NVD
Post
SolarWinds Serv-U Hit by Critical IDOR Flaw CVE-2026-28302
From The CircuitryWhy The Circuitry

Verified tech news, cross-checked.

Every story is checked against independent sources before it posts — no rumors dressed up as fact.

How we verify →
TL;DRAI · 60 sec read

SolarWinds disclosed a critical IDOR flaw, CVE-2026-28302, in Serv-U file transfer software versions 15.5.4 HF1 and below. The vulnerability carries a CVSS 9.1 score and lets group administrators escalate privileges to execute code as root on Linux and Windows. SolarWinds released version 2026-3 to address it.

SolarWinds has disclosed a critical vulnerability in its Serv-U file transfer software that enables privilege escalation and remote code execution as root.

Serv-U carries a CVSS 9.1 rating. The insecure direct object reference flaw, tracked as CVE-2026-28302, was published to the NVD on July 21, 2026. SolarWinds rates it CVSS 3.1 with base score 9.1 and vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.
The vulnerability allows privilege escalation and remote code execution as root on affected deployments.

The issue requires group administrator access to exploit.

Impact varies by operating system. The vulnerability allows privilege escalation and remote code execution as root on affected deployments. Its impact is lower in Windows deployments compared with Linux.
From The CircuitryThe Feed — live briefs across tech, all day.See what’s happening →

Affected versions are listed in the advisory. Serv-U versions 15.5.4 HF1 and below are affected on both Windows and Linux platforms. The disclosure lists the product default status as unaffected for versions beyond that range.
Its impact is lower in Windows deployments compared with Linux.

Remediation guidance is available now. SolarWinds published release notes for Serv-U 2026-3 that address the flaw. The company also posted a dedicated security advisory at its trust center.
From The CircuitryWhy The Circuitry

Verified tech news, cross-checked.

Every story is checked against independent sources before it posts — no rumors dressed up as fact.

How we verify →
The CVE record was received from SolarWinds on July 21, 2026 at 12:17:07 PM and added to the NVD dataset the same day. It maps to CWE-639, authorization bypass through user-controlled key.

EXPERT TAKE

Enterprise file-transfer teams running Serv-U on Linux should prioritize the 2026-3 upgrade, as the root-level remote code execution risk is materially higher than on Windows.

Why this mattersAI · ~100 words

Tap a lens to see what this story means for you.

Reader-supported
DonateBuy me a coffee →Follow@thecircuitry_ →Follow@thecircuitry.to →

Reader-supported · The Brief

Liked this? The Brief brings you the whole day in tech, verified, every morning. Two minutes, free forever.

HELP US IMPROVE
From The Circuitry

See what’s happening right now

The Feed runs all day — short, verified briefs the moment they break.

Open the Feed →
From The Circuitry

Follow @thecircuitry_

Every story we publish, as it happens. No noise between.

Follow on X ↗On Bluesky ↗

Reader-supported

The Circuitry is a passion project I've always wanted to build, and I love the work behind it.

Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.

Any contribution is appreciated. If not, no pressure. Thanks for reading.

Buy me a coffee
SolarWindsVulnerabilityCVE
More fromNVD
  • IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 Face High-Severity Flaw

    Tech · 15d
  • IBM Db2 Releases Face Privilege Escalation Risk

    Tech · 23d
  • Microsoft Azure Kubernetes Service CVE-2026-50516 Hits CVSS 9.4

    Tech · 24d
More inTech
  • Tesla Unveils Production Cybercab With Unboxed Manufacturing

    Tech · 3h
  • NHTSA Launches Probe Into Tesla Cybercab as Austin Rides Begin

    Tech · 9h
  • VW Plans 100k Job Cuts, May Halt EV Production at 4 Plants

    Tech · 1d
SupportThe Work

The Circuitry is reader-supported. If you find the daily brief useful, you can buy me a coffee to keep it going.

Buy a coffee →
SubscribeCircuitry Brief

Liked this? The Brief brings you the whole day in tech, verified, every morning. Free forever.

From The CircuitryWhy The Circuitry

Verified tech news, cross-checked.

Every story is checked against independent sources before it posts — no rumors dressed up as fact.

How we verify →

MORE IN TECH

Tesla Unveils Production Cybercab With Unboxed Manufacturing

Tesla revealed the production Cybercab at an Austin event on September 4, 2026, showcasing its unboxed manufacturing process and new hardware components. The two-seater autonomous vehicle uses a pure-vision system with a drag coefficient under 0.20 and omits any immediate plans for individual customer sales.

NHTSA Launches Probe Into Tesla Cybercab as Austin Rides Begin

Tesla began public rides in its steering-wheel-free Cybercab in Austin this evening while NHTSA opened an Audit Query into the company’s determination that the vehicle meets existing federal safety standards. The review targets Tesla’s self-certification at a moment when the agency is revising eight rules for driverless cars and other robotaxi developers have secured exemptions.

VW Plans 100k Job Cuts, May Halt EV Production at 4 Plants

Volkswagen's supervisory board has unanimously approved the Future Plan 2030, which includes an additional 50,000 job cuts worldwide to reach a total of around 100,000 and leaves four German plants without secured future vehicle production after 2031-2034. The move aims to reduce costs and improve competitiveness against Chinese rivals, with alternative uses for the factories to be examined by June 2027.