#solarwinds
23 articles
CVE-2026-28336: Command Injection in SolarWinds Dameware
SolarWinds Dameware is affected by a command injection vulnerability that could lead to the compromise of the remotely controlled host. Authentication is required...
CVE-2026-28302: IDOR to RCE via Group Admin in SolarWinds Serv-U
SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation and remote code execution as root. This issue requires group administrat...
CVE-2026-28304: Remote Code Execution as Root in SolarWinds Serv-U
SolarWinds Serv-U is affected by a remote code execution vulnerability that, when exploited, can allow the arbitrary execution of code remotely as root. The impact is lower in Windows deployments....
CVE-2026-28305: IDOR to RCE via Domain Account in SolarWinds Serv-U
SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution as root. A domain account with admin privileges and read and write acce...
CVE-2026-28306: Privilege Escalation to SysAdmin in SolarWinds Serv-U
SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to elevate their privileges to a system administrator. The impact is lower in Windows deploymen...
CVE-2026-28307: Privilege Escalation to Admin Group in SolarWinds Serv-U
SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain user group to be elevated into an administrator group. The impact is lower in Windows deployments....
CVE-2026-28308: IDOR to RCE via Domain Admin in SolarWinds Serv-U
SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution. Domain administrator access is required. The impact is lower in Window...
CVE-2026-28309: Broken Access Control in SolarWinds Serv-U
SolarWinds Serv-U is affected by a broken access control vulnerability that allows a domain administrator to create system administrator accounts. The impact is lower in Windows deployments....
CVE-2026-28310: User Type Escalation to SysAdmin in SolarWinds Serv-U
SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to escalate their user type to that of a system administrator. The impact is lower in Windows d...
CVE-2026-28312: Group Privilege Escalation to Root in SolarWinds Serv-U
SolarWinds Serv-U is affected by a privilege escalation vulnerability. This would elevate a group’s access to system administrator and allow code execution as root. The impact is lower in Windows depl...
CVE-2026-28313: IDOR to SMTP Hijacking Account Takeover in SolarWinds Serv-U
SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to SMTP hijacking leading to arbitrary account takeover. The impact is lower in Windows deployme...
CVE-2026-28314: IDOR to Account Takeover in SolarWinds Serv-U
SolarWinds Serv-U is affected by an insecure direct object reference vulnerability that leads to an account takeover. User authentication is required. The impact is lower in Windows deployments....
CVE-2026-28316: IDOR to Root Privilege Escalation in SolarWinds Serv-U
SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation to a system administrator with the ability to execute commands as the ro...
CVE-2026-28317: IDOR to Privilege Escalation in SolarWinds Serv-U
SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation. This issue requires domain administrator access. The impact is lower in...
CVE-2026-28321: Broken Access Control to Root RCE in SolarWinds Serv-U
SolarWinds Serv-U is affected by a broken access control vulnerability that could allow arbitrary file read and write, which can then be used to escalate privileges and execute code as root. A domain ...
CVE-2026-28318: SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability
SolarWinds Serv-U contains an uncontrolled resource consumption vulnerability that allows specially crafted POST requests using the Content-Encoding: deflate header to crash the Serv-U service without...
CVE-2025-26399: SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability
SolarWinds Web Help Desk contain a deserialization of untrusted data vulnerability in AjaxProxy that could allow an attacker to run commands on the host machine....
CVE-2025-40538: Access control bypass in Solarwinds Serv-U
A broken access control vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to create a system admin user and execute arbitrary code as a privileged account via do...
CVE-2025-40539: Type confusion leading to RCE in SolarWinds Serv-U
Security Alert - CVE-2025-40539 (Solarwinds Serv-U). CVSS: 9.1 (critical). EPSS: 0%.
CVE-2025-40540: Type confusion leading to RCE in SolarWinds Serv-U
Security Alert - CVE-2025-40540 (Solarwinds Serv-U). CVSS: 9.1 (critical). EPSS: 0%.
CVE-2025-40541: IDOR leading to RCE in SolarWinds Serv-U
Security Alert - CVE-2025-40541 (Solarwinds Serv-U). CVSS: 9.1 (critical). EPSS: 0%.
CVE-2025-40536: SolarWinds Web Help Desk Security Control Bypass Vulnerability
SolarWinds Web Help Desk contains a security control bypass vulnerability that could allow an unauthenticated attacker to gain access to certain restricted functionality....
CVE-2025-40551: SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability
SolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This co...