Skip to content
CVE Tracker
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
SolarWinds

SolarWinds Serv-U vulnerabilities

34 published CVEs name SolarWinds Serv-U among the affected products; CISA lists 2 of them as exploited in the wild.

All 34 in the listAtom feed of new CVEs
Published CVEs
34
Last 12 months
23
Critical
21
Known exploited
2

Critical 21High 6Medium 6Low 1Not scored 0

CVEs per yearBy the year they were published

  1. 20211
  2. 20223
  3. 20233
  4. 20243
  5. 20254
  6. 202620

Known exploitedNewest addition to KEV first

  • CVE-2026-28318

    SolarWinds Serv-U Unauthenticated Denial of Service Vulnerability

    SolarWinds · Serv-U

    ExploitedHigh7.5
  • CVE-2021-35247

    Improper Input Validation Vulnerability in Serv-U

    SolarWinds · Serv-U

    ExploitedMedium4.3

Newest CVEs

  • CVE-2026-28321

    SolarWinds Serv-U Broken Access Control Vulnerability

    SolarWinds · Serv-U

    Critical9.1
  • CVE-2026-28317

    SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability

    SolarWinds · Serv-U

    Critical9.1
  • CVE-2026-28316

    SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability

    SolarWinds · Serv-U

    Critical9.1
  • CVE-2026-28315

    SolarWinds Serv-U Authenticated Stored Cross-site Scripting (XSS) Vulnerability

    SolarWinds · Serv-U

    Medium6.2
  • CVE-2026-28314

    SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability

    SolarWinds · Serv-U

    Critical9.1
  • CVE-2026-28313

    SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability

    SolarWinds · Serv-U

    Critical9.1
  • CVE-2026-28312

    SolarWinds Serv-U Privilege Escalation Vulnerability

    SolarWinds · Serv-U

    Critical9.1
  • CVE-2026-28310

    SolarWinds Serv-U Privilege Escalation Vulnerability

    SolarWinds · Serv-U

    Critical9.1
  • CVE-2026-28309

    SolarWinds Serv-U Broken Access Control Vulnerability

    SolarWinds · Serv-U

    Critical9.1
  • CVE-2026-28308

    SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability

    SolarWinds · Serv-U

    Critical9.1

Most common weaknesses

  1. CWE-639 Authorization bypass through a user-controlled key (IDOR)8
  2. CWE-284 Improper access control7
  3. CWE-20 Improper input validation3
  4. CWE-22 Path traversal3
  5. CWE-704 3
  6. CWE-79 Cross-site scripting (XSS)3
  7. CWE-269 Improper privilege management2
  8. CWE-862 Missing authorization2
  9. CWE-116 Improper encoding or escaping of output1
  10. CWE-285 Improper authorization1