SolarWinds Serv-U: 15 flaws fixed in 2026.3 (CVE-2026-28302 et al.)

SolarWinds Serv-U, a file-transfer server widely used by enterprises, has 15 flaws disclosed at once, 14 of them rated 9.1 (Critical). Led by CVE-2026-28302, the set lets a user who holds administrator privileges read and write files beyond their intended limits and, ultimately, run code on the server (takeover). The impact is described as larger on Linux/Unix builds.

Affected are all versions up to and including Serv-U 15.5.4 Hotfix 1 (HF1); the fix is Serv-U 2026.3, released July 21, 2026. Serv-U is a "hub" where sensitive transferred data collects, and the product just had a separate, actively exploited denial-of-service flaw (CVE-2026-28318). Below we walk through what happens and how to respond.

Who targets this, and why

The people who can exploit the 14 flaws rated 9.1 are those who hold a Serv-U admin account (domain or group administrator), or who obtained one somehow. This is not a no-login, anyone-from-outside vulnerability. But for a malicious insider, an attacker who phished an admin's credentials, or one who broke in another way and wants to widen access, it is an ideal "next move."

Using this set, an attacker performs file reads and writes that should be off-limits by confusing which object is targeted (IDOR), and turns that into code execution on the server. IDOR (insecure direct object reference) is a flaw where an off-limits object is manipulated by swapping an identifier. SolarWinds describes the result as "native code execution with privileged (root/administrator) authority." On Linux/Unix in particular, the impact of that privilege is larger.

The scale of damage isn't small. A file-transfer server like Serv-U is a chokepoint through which contracts, personal data, and confidential files pass and are stored. A takeover can mean bulk exfiltration, tampering, and a foothold into the internal network. File-transfer products have been prime targets for large-scale data theft and extortion in the past — so even with an admin prerequisite, this is not something to sit on. That's why the update below should be done promptly.

All 15 were reported through the Intigriti bug bounty program that SolarWinds runs. The release notes name no individual researcher or research team, and no finder write-up has been published. With the mechanics unpublished, attackers have little to reproduce from for now.

Breakdown of the 15 flaws

Fourteen of the 15 are the same family: "broken access control" or "IDOR" that lets someone read/write files beyond their intended scope and chain it into privileged code execution. All 14 are rated 9.1 (Critical) and share the prerequisite of a Serv-U admin. The specific entry points (which feature or parameter is abused) differ, but they all lead to "file operations beyond the limit" and "server takeover." The remaining one, CVE-2026-28315, is a different family: a stored XSS where planted markup runs in an administrator's browser, leading to session hijacking or information disclosure.

This many at once likely reflects a shared weakness in how Serv-U handles privileges, surfacing feature by feature. The CVE numbers differ, but since any single one can lead to a privileged takeover, updating to Serv-U 2026.3 is the only reliable fix.

Note that some write-ups and lists include CVE-2026-28303 or CVE-2026-28311 in this batch. Neither has an entry in NVD. 28303 does not appear in the SolarWinds release notes either; 28311 is listed there but has no NVD record as of this update. If you reconcile by CVE ID, use the 15 in the table above as your baseline.

Affected scope (version / OS quick reference)

Whether you're affected comes down to the Serv-U version you run. Check it in the management console or the install details.

SolarWinds notes the impact is larger on Linux/Unix than on Windows. But the flaws exist on Windows too, so update regardless of OS. Internet-facing Serv-U instances in particular should be prioritized, since a compromised admin account would do the most damage there.

The versioning scheme changed

The part of this update that trips people up is the version string. SolarWinds moved Serv-U from dotted numbering like "15.5.4" to calendar-style numbering like "2026.3." What follows 15.5.4 HF1 is therefore neither 15.5.5 nor 15.5.4 Hotfix 2 — it is 2026.3. If your asset inventory or patching runbook says "move to the latest 15.5.x," rewrite that line now.

The current shipping release is stated at the top of the Serv-U release history as "Current version." The list of fixed CVEs, with descriptions, severities, and credit, is in the 2026.3 release notes. NVD cites those same release notes as the patch reference for each CVE, so you can use it as the reconciliation baseline.

What to do right now

The fix is to update Serv-U to 2026.3. All 15 require admin privileges, so they're not a no-login, mass-scan case — but since any one can lead to a privileged takeover, closing them together is the sure move. Downloads and notes are available via SolarWinds' security advisories (Trust Center) and the 2026.3 release notes.

If you can't update immediately, useful stopgaps are to audit your Serv-U admin accounts, trim unnecessary admin privileges, enforce strong (multi-factor) authentication, and restrict how the management console can be reached. Since abuse hinges on admin privileges, "limit who can even become an admin" curbs the damage. Also confirm you've already handled the unauthenticated denial-of-service flaw (CVE-2026-28318) — fixed in 15.5.4 HF1 and carried forward into 2026.3.

As of this update, there is no report of these 15 being used in real attacks. No proof-of-concept code turns up on GitHub, and trade coverage states plainly that there is no proof-of-concept or active exploitation. Nothing is listed on the U.S. CISA catalog of actively exploited vulnerabilities (KEV) either, and no further Serv-U CVEs or hotfixes have shipped since 2026.3. You can check how far attacks are spreading in our tracker of actively exploited vulnerabilities.

Where CVE-2026-28318 stands now

Separate from these 15, Serv-U has an actively exploited denial-of-service flaw, CVE-2026-28318. It is exploitable without authentication, was added to CISA's KEV on June 5, 2026, and carried a U.S. federal remediation due date of June 19. The fix shipped in 15.5.4 Hotfix 1 (June 3, 2026) and is carried forward into 2026.3.

KEV listing notwithstanding, who is behind the attacks is still unknown. CISA still records ransomware use as "Unknown," and no threat group has been publicly tied to it. Exposure remains substantial: roughly 12,000 Serv-U instances reachable per Shodan, and about 3,100 per Shadowserver.

One caution: searching turns up material pairing Serv-U with the Clop ransomware group or the actor tracked as DEV-0322. That material is about CVE-2021-35211, a separate flaw disclosed in 2021, and has nothing to do with CVE-2026-28318 or the 15 flaws here. Keep them apart when you brief your organization.

FAQ

Summary

SolarWinds Serv-U, used for enterprise file transfer, has 15 flaws disclosed at once, 14 of them rated 9.1. Led by CVE-2026-28302, these access-control/IDOR flaws let an admin-privileged party read/write files beyond limits and reach privileged code execution (takeover), with larger impact on Linux/Unix. The remaining one, CVE-2026-28315, is a stored XSS (6.2) leading to session hijacking or information disclosure from an administrator account. All came in through the Intigriti bug bounty program, with no in-the-wild exploitation and no public proof-of-concept.

The fix is Serv-U 2026.3. The version string is the easy thing to get wrong: SolarWinds moved to calendar versioning, so there is no 15.5.5 and no 15.5.4 Hotfix 2 — what follows 15.5.4 HF1 is 2026.3. Also audit admin accounts, enforce MFA, and restrict console reachability. The earlier CVE-2026-28318 remains KEV-listed with no attribution, and the "Clop" and "DEV-0322" material you'll find in search results belongs to a 2021 flaw (CVE-2021-35211). Don't conflate them — just get to 2026.3.

Sources

• ▸ SolarWinds - Serv-U 2026.3 release notes (July 21, 2026: fixed CVEs and credit)
• ▸ SolarWinds - Serv-U release history (Current version: 2026.3)
• ▸ NVD - CVE-2026-28302 (SolarWinds Serv-U broken access control / IDOR → privileged code exec) and the other CVEs above
• ▸ NVD - CVE-2026-28315 (SolarWinds Serv-U stored XSS, 6.2)
• ▸ SolarWinds - Security advisories (Trust Center)
• ▸ CISA - Known Exploited Vulnerabilities Catalog (CVE-2026-28318 listing)
• ▸ SolarWinds Serv-U product page
• ▸ Related: SolarWinds Serv-U denial-of-service flaw CVE-2026-28318 (this site)
• ▸ Related: tracker of actively exploited vulnerabilities, CISA KEV (this site)