CVE-2026-28304

CVSS 3.1: 9.1 critical
EPSS: <1%p54
Published: Jul 21, 2026 · Jul 21, 2026
Modified: Oct 24, 2026

Analyze CVE-2026-28304 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

SolarWinds Serv-U is affected by a remote code execution vulnerability that, when exploited, can allow the arbitrary execution of code remotely as root. The impact is lower in Windows deployments.

Vendors: solarwinds

Products: serv-u

Weakness: CWE-284

Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.8%)

In the news

1 story

SolarWinds Patches ARM Hard-Coded Key Flaw Enabling Unauthenticated RCE

SolarWinds patched CVE-2026-28326 (CVSS 8.8), a hard-coded-key flaw enabling unauthenticated remote code execution in Access Rights Manager 2026.2 and prior.

The Hacker NewsSep 19, 09:31 UTC · Sep 19, 2026VulnerabilityCVE-2026-28299 CVE-2026-28302 CVE-2026-28304+42