CVE-2026-28308 Overview
CVE-2026-28308 is an Insecure Direct Object Reference (IDOR) vulnerability in SolarWinds Serv-U that can lead to remote code execution. Exploitation requires domain administrator access, and the impact is reduced in Windows deployments. The flaw is classified under CWE-639: Authorization Bypass Through User-Controlled Key. SolarWinds addressed the issue in the Serv-U 2026.3 release.
Critical Impact
An authenticated domain administrator can abuse improper authorization checks in Serv-U to reference restricted objects and achieve remote code execution on the underlying host.
Affected Products
- SolarWinds Serv-U (versions prior to 2026.3)
- SolarWinds Serv-U File Server deployments on non-Windows platforms (higher impact)
- SolarWinds Serv-U File Server deployments on Windows (lower impact)
Discovery Timeline
- 2026-07-21 - CVE-2026-28308 published to NVD
- 2026-07-22 - Last updated in NVD database
Technical Details for CVE-2026-28308
Vulnerability Analysis
SolarWinds Serv-U exposes object identifiers that the application uses to reference internal resources. The vulnerability arises when the server accepts these identifiers from an authenticated request without verifying that the caller is authorized to act on the referenced object. An attacker who already holds domain administrator credentials can substitute identifiers to reach objects and code paths that should be out of reach for their role.
Because the reachable code paths include functionality that touches the file system and execution surface, the IDOR chain escalates into remote code execution on the Serv-U host. The advisory notes that Windows deployments experience lower impact, which typically reflects tighter platform-level restrictions on the affected operations. See the SolarWinds Security Advisory CVE-2026-28308 for vendor-specific detail.
Root Cause
The root cause is a missing authorization check on a user-controlled key ([CWE-639]). Serv-U relies on the presence of authentication and the object reference supplied by the client, but does not enforce ownership or role-based access on the referenced object before executing the requested operation.
Attack Vector
The attack vector is network-based and requires high privileges. An authenticated domain administrator sends crafted requests to the Serv-U management interface, manipulating object references to invoke restricted operations. Successful exploitation crosses a security scope boundary and yields code execution in the Serv-U service context.
No verified public exploit code is available for CVE-2026-28308. The EPSS probability is 0.546% as of 2026-07-23. Refer to the Serv-U 2026.3 release notes for the patched behavior.
Detection Methods for CVE-2026-28308
Indicators of Compromise
- Unexpected process creation spawned by the Serv-U service account (Serv-U.exe or the Linux daemon) invoking shells, scripting engines, or system utilities.
- Anomalous file writes to Serv-U configuration or web-root directories immediately following authenticated administrative sessions.
- Serv-U audit log entries showing administrative operations against object IDs that do not correspond to the acting administrator's normal scope.
Detection Strategies
- Correlate authenticated Serv-U admin sessions with subsequent child-process activity on the host; legitimate administration rarely produces interactive shells.
- Baseline the set of object identifiers each domain administrator typically references and alert on sudden expansion of that set.
- Inspect Serv-U HTTP request logs for repeated enumeration of sequential or unusual object identifiers within a short window.
Monitoring Recommendations
- Forward Serv-U application, audit, and web server logs to a centralized log platform and retain them for incident review.
- Monitor outbound network connections initiated by the Serv-U service for signs of tool download or command-and-control activity.
- Track integrity of Serv-U binaries and configuration files, alerting on modification outside of scheduled maintenance windows.
How to Mitigate CVE-2026-28308
Immediate Actions Required
- Upgrade Serv-U to version 2026.3 or later as described in the Serv-U 2026.3 release notes.
- Review and reduce the number of accounts granted domain administrator privileges within Serv-U.
- Rotate credentials for any domain administrator accounts that were active before patching.
Patch Information
SolarWinds fixed CVE-2026-28308 in Serv-U 2026.3. Apply the vendor-supplied installer to all Serv-U servers, including standby and disaster-recovery nodes. Validate the patched version through the Serv-U management console after upgrade. Detailed remediation guidance is available in the SolarWinds Security Advisory CVE-2026-28308.
Workarounds
- Restrict network access to the Serv-U administrative interface to trusted management subnets until the patch is applied.
- Enforce multi-factor authentication on all Serv-U domain administrator accounts to raise the cost of credential abuse.
- Segregate Serv-U administrative duties so that no single account has both domain administrator rights and broad file-system access on the host.
# Configuration example: restrict access to Serv-U management port with host firewall
# (adjust interface, admin port, and trusted CIDR to match your environment)
sudo iptables -A INPUT -p tcp --dport 43958 -s 10.10.20.0/24 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 43958 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
