Cve 2026 28304

www.solarwinds.com • July 23, 2026

SolarWinds Serv-U is affected by a remote code execution vulnerability that, when exploited, can allow the arbitrary execution of code remotely as root. The impact is lower in Windows deployments.

SolarWinds Serv-U 15.5.4 HF1 and below

SolarWinds Serv-U 2026.3

Intigriti Bug Bounty Program

SolarWinds Serv-U 2026.3

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in SolarWinds Serv-U Require Immediate Patching SolarWinds has identified 15 critical vulnerabilities in its Serv-U software, including two that allow remote code execution (RCE). The vulnerabilities, with CVSS scores of 9.1, affect versions 15.5.4 HF1 and below, as well as Serv-U 2026.3. Attackers can exploit these vulnerabilities to execute arbitrary code and escalate privileges. The vulnerabilities were published on 2026-07-21, and users are urged to apply patches immediately to mitigate risks. The Serv-U software is widely used for managed file transfers, making it a significant target for cybercriminals. Previous incidents, such as the MOVEit attacks, highlight the dangers of unpatched vulnerabilities in data transfer solutions. Administrators are advised to review the release notes for detailed information on the vulnerabilities and the necessary updates. 3 sources 73

Cve 2026 28304

The full story

Extracted Entities

CWE Weaknesses (1)

Platforms (2)