critical9.1

CVE-2026-28313

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to SMTP hijacking leading to arbitrary account takeover.

Impact

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to SMTP hijacking leading to arbitrary account takeover. The impact is lower in Windows deployments.

Affected products

Vendor	Product	Affected versions
Solarwinds	Serv-U	before 2026.3

Weakness classification

CWE-639

References

NVD record
CVE.org record
https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_2026-3_release_notes.htm
https://https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28313