What’s Vulnerable › Products

SolarWinds Serv-U vulnerabilities

55 known vulnerabilities, 4 confirmed exploited in the wild (CISA KEV), 24 published in the last 12 months.

Check whether your SolarWinds Serv-U version is affected

Exploited SolarWinds Serv-U vulnerabilities

• CVE-2026-28318 — SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability
• CVE-2024-28995 — SolarWinds Serv-U Path Traversal Vulnerability
• CVE-2021-35247 — SolarWinds Serv-U Improper Input Validation Vulnerability
• CVE-2021-35211 — SolarWinds Serv-U Remote Code Execution Vulnerability

Latest SolarWinds Serv-U vulnerabilities

• CVE-2026-28321 — SolarWinds Serv-U Broken Access Control Vulnerability (CVSS 9.1)
• CVE-2026-28317 — SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability (CVSS 9.1)
• CVE-2026-28316 — SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability (CVSS 9.1)
• CVE-2026-28315 — SolarWinds Serv-U Authenticated Stored Cross-site Scripting (XSS) Vulnerability (CVSS 6.2)
• CVE-2026-28314 — SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability (CVSS 9.1)
• CVE-2026-28313 — SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability (CVSS 9.1)
• CVE-2026-28312 — SolarWinds Serv-U Privilege Escalation Vulnerability (CVSS 9.1)
• CVE-2026-28310 — SolarWinds Serv-U Privilege Escalation Vulnerability (CVSS 9.1)
• CVE-2026-28309 — SolarWinds Serv-U Broken Access Control Vulnerability (CVSS 9.1)
• CVE-2026-28308 — SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability (CVSS 9.1)
• CVE-2026-28307 — SolarWinds Serv-U Privilege Escalation Vulnerability (CVSS 9.1)
• CVE-2026-28306 — SolarWinds Serv-U Privilege Escalation Vulnerability (CVSS 9.1)
• CVE-2026-28305 — SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability (CVSS 9.1)
• CVE-2026-28304 — SolarWinds Serv-U Remote Code Execution Vulnerability (CVSS 9.1)
• CVE-2026-28302 — SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability (CVSS 9.1)
• CVE-2026-28318 — SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability (CVSS 7.5) — exploited
• CVE-2025-40541 — SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Remote Code Execution Vulnerability (CVSS 7.2)
• CVE-2025-40540 — SolarWinds Serv-U Type Confusion Remote Code Execution Vulnerability (CVSS 7.2)
• CVE-2025-40539 — SolarWinds Serv-U Type Confusion Remote Code Execution Vulnerability (CVSS 7.2)
• CVE-2025-40538 — SolarWinds Serv-U Broken Access Control Remote Code Execution Vulnerability (CVSS 7.2)
• CVE-2025-40549 — SolarWinds Serv-U Path Restriction Bypass Vulnerability (CVSS 9.1)
• CVE-2025-40548 — SolarWinds Serv-U Broken Access Control - Remote Code Execution Vulnerability (CVSS 9.1)
• CVE-2025-40547 — SolarWinds Serv-U Logic Abuse - Remote Code Execution Vulnerability (CVSS 9.1)
• CVE-2024-45712 — SolarWinds Serv-U Client-Side Cross-Site Scripting Vulnerability (CVSS 5.4)
• CVE-2024-45714 — SolarWinds Serv-U Stored XSS Vulnerability (CVSS 4.1)