CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 05:50 UTC)

What this means for you

This week: 5,436 CVEs published, 357 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,436; Show in the list
Critical, last 7 days: 357; Show in the list
Healthcare-tagged, last 7 days: 4; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

Showing CVEs that name the product solarwinds:serv-u. Show all products

26 CVEs, showing 1 to 26

CVE	Severity	Title	Published
CVE-2026-28321	Critical 9.1	SolarWinds Serv-U is affected by a broken access control vulnerability that could allow arbitrary file read and write, which can then be used to escalate privileges and execute code as root.	Jul 21, 2026
CVE-2026-28317	Critical 9.1	SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation.	Jul 21, 2026
CVE-2026-28316	Critical 9.1	SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation to a system administrator with the ability to execute commands as the r…	Jul 21, 2026
CVE-2026-28315	Medium 6.2	SolarWinds Serv-U was found to be affected by a stored cross-site scripting vulnerability that could lead to session hijacking or information disclosure from an administrator account.	Jul 21, 2026
CVE-2026-28314	Critical 9.1	SolarWinds Serv-U is affected by an insecure direct object reference vulnerability that leads to an account takeover.	Jul 21, 2026
CVE-2026-28313	Critical 9.1	SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to SMTP hijacking leading to arbitrary account takeover.	Jul 21, 2026
CVE-2026-28312	Critical 9.1	SolarWinds Serv-U is affected by a privilege escalation vulnerability.	Jul 21, 2026
CVE-2026-28310	Critical 9.1	SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to escalate their user type to that of a system administrator.	Jul 21, 2026
CVE-2026-28309	Critical 9.1	SolarWinds Serv-U is affected by a broken access control vulnerability that allows a domain administrator to create system administrator accounts.	Jul 21, 2026
CVE-2026-28308	Critical 9.1	SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution.	Jul 21, 2026
CVE-2026-28307	Critical 9.1	SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain user group to be elevated into an administrator group.	Jul 21, 2026
CVE-2026-28306	Critical 9.1	SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to elevate their privileges to a system administrator.	Jul 21, 2026
CVE-2026-28305	Critical 9.1	SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution as root.	Jul 21, 2026
CVE-2026-28304	Critical 9.1	SolarWinds Serv-U is affected by a remote code execution vulnerability that, when exploited, can allow the arbitrary execution of code remotely as root.	Jul 21, 2026
CVE-2026-28302	Critical 9.1	SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation and remote code execution as root.	Jul 21, 2026
CVE-2026-28318 Known exploited	High 7.5	SolarWinds Serv-U Unauthenticated Denial of Service Vulnerability Assigned by SolarWinds	Jun 4, 2026
CVE-2025-40541	High 7.2	An Insecure Direct Object Reference (IDOR) vulnerability exists in Serv-U, which when exploited, gives a malicious actor the ability to execute native code as a privileged account.	Feb 24, 2026
CVE-2025-40540	High 7.2	A type confusion vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to execute arbitrary native code as privileged account.	Feb 24, 2026
CVE-2025-40539	High 7.2	A type confusion vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to execute arbitrary native code as privileged account.	Feb 24, 2026
CVE-2025-40538	High 7.2	A broken access control vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to create a system admin user and execute arbitrary code as a privileged account via d…	Feb 24, 2026
CVE-2025-40549	Critical 9.1	A Path Restriction Bypass vulnerability exists in Serv-U that when abused, could give a malicious actor with access to admin privileges the ability to execute code on a directory.	Nov 18, 2025
CVE-2025-40548	Critical 9.1	A missing validation process exists in Serv U when abused, could give a malicious actor with access to admin privileges the ability to execute code.	Nov 18, 2025
CVE-2025-40547	Critical 9.1	A logic error vulnerability exists in Serv-U which when abused could give a malicious actor with access to admin privileges the ability to execute code.	Nov 18, 2025
CVE-2024-28995 Known exploited	High 8.6	SolarWinds Serv-U L Directory Transversal Vulnerability Assigned by SolarWinds	Jun 6, 2024
CVE-2021-35247 Known exploited	Medium 4.3	Improper Input Validation Vulnerability in Serv-U Assigned by SolarWinds	Jan 7, 2022
CVE-2021-35211 Known exploited	Critical 9.0	Serv-U Remote Memory Escape Vulnerability Assigned by SolarWinds	Jul 14, 2021

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.