CVE-2026-28315: SolarWinds Serv-U XSS Vulnerability

CVE-2026-28315 Overview

CVE-2026-28315 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in SolarWinds Serv-U file transfer software. An attacker with high privileges can inject malicious script content that persists in the application. When an administrator later views the affected page, the script executes in the administrator's browser context. Successful exploitation can lead to session hijacking or disclosure of information from an administrator account. The issue requires user interaction and is exploitable over the network. SolarWinds addressed the vulnerability in the Serv-U 2026.3 release.

Critical Impact
Stored XSS payloads execute in an administrator's browser session, enabling session hijacking and exposure of privileged account information.

Affected Products

SolarWinds Serv-U (versions prior to 2026.3)
SolarWinds Serv-U File Server
SolarWinds Serv-U Managed File Transfer (MFT) Server

Discovery Timeline

2026-07-21 - CVE-2026-28315 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-28315

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw in SolarWinds Serv-U. Serv-U fails to properly neutralize user-controllable input before it is placed into output that is later rendered to administrative users. Because the payload is persisted server-side, any privileged user viewing the affected view triggers script execution. The Exploit Prediction Scoring System places CVE-2026-28315 in the 20th percentile, indicating low observed exploitation activity to date. Exploitation still requires an authenticated actor with elevated privileges plus victim interaction, which narrows the practical attack surface but does not eliminate risk in multi-tenant or delegated-administration deployments.

Root Cause

The root cause is improper neutralization of input during web page generation, classified as [CWE-79]. Data submitted through an authenticated Serv-U interface is stored without adequate output encoding or contextual sanitization. When the stored value is rendered inside an administrative page, injected HTML or JavaScript is interpreted by the browser instead of being treated as text.

Attack Vector

An authenticated attacker holding a high-privilege Serv-U account submits crafted input containing script content into a persistent field. The payload remains stored in Serv-U. When an administrator subsequently loads the page containing that data, the browser executes the script under the administrator's session. The attacker can then exfiltrate the session cookie, perform actions as the administrator, or read sensitive information rendered in the administrative interface. The attack requires network access to the Serv-U management interface and user interaction from the victim administrator.

No public proof-of-concept exploit code is available. See the SolarWinds Security Advisory CVE-2026-28315 for vendor technical details.

Detection Methods for CVE-2026-28315

Indicators of Compromise

Serv-U configuration fields or user-supplied metadata containing <script>, onerror=, onload=, javascript:, or encoded equivalents.
Administrative sessions producing unexpected outbound HTTP requests to attacker-controlled domains shortly after loading Serv-U pages.
New or modified Serv-U administrator accounts, group memberships, or FTP shares that cannot be tied to a legitimate change ticket.
Duplicate active sessions for the same administrator account originating from distinct source IP addresses.

Detection Strategies

Review Serv-U audit logs for input submissions to user, group, domain, or file-metadata fields containing HTML or JavaScript syntax.
Inspect web server access logs for administrator requests immediately followed by anomalous outbound requests from admin workstations.
Correlate authentication events with configuration changes to detect actions performed via a hijacked administrator session.

Monitoring Recommendations

Ingest Serv-U application, web, and audit logs into a centralized analytics platform such as Singularity Data Lake for OCSF-normalized search and retention.
Alert on privileged Serv-U account activity outside expected administrative hours or from unusual geolocations.
Monitor administrator endpoints with Singularity Endpoint to identify browser-based script execution or credential theft following Serv-U session activity.

How to Mitigate CVE-2026-28315

Immediate Actions Required

Upgrade SolarWinds Serv-U to version 2026.3 or later as documented in the Serv-U 2026.3 Release Notes.
Audit existing Serv-U configuration fields, user profiles, group descriptions, and file metadata for stored script payloads and remove any suspicious content.
Invalidate active administrator sessions and force password resets for all Serv-U administrative accounts.
Review the accounts holding the high privileges required to inject stored content and remove any unnecessary elevation.

Patch Information

SolarWinds resolved CVE-2026-28315 in Serv-U 2026.3. The fix introduces proper input neutralization and output encoding for the affected fields. Refer to the SolarWinds Security Advisory CVE-2026-28315 for the authoritative fixed-version statement and installation guidance.

Workarounds

Restrict access to the Serv-U management interface to a dedicated administrative network segment or VPN.
Enforce a strict Content Security Policy on the reverse proxy fronting Serv-U to limit inline script execution in administrator browsers.
Require multi-factor authentication for every account with privileges capable of writing to the affected fields.
Use separate hardened workstations for Serv-U administration to reduce the value of a hijacked session.

bash

# Configuration example: nginx reverse proxy CSP header for Serv-U admin interface
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'none'; base-uri 'self'" always;
add_header X-Frame-Options "DENY" always;
add_header X-Content-Type-Options "nosniff" always;