- 246/2026
- Critical
SolarWinds has released security updates to address several vulnerabilities affecting multiple SolarWinds products.
The addressed vulnerabilities could allow the attacker to perform stored cross-site cripting attacks, gain elevated privileges, manipulate files, or execute arbitrary code, and gain access to the affected systems.
Sample of the addressed vulnerabilities:
1. SolarWinds Serv-U Remote Code Execution Vulnerability (CVE-2026-28311):
- CVSS: 9.1
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: High
- User Interaction: None
- Consequences: Remote Code Execution
2. SolarWinds Serv-U Privilege Escalation Vulnerability (CVE-2026-28310):
- CVSS: 9.1
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: High
- User Interaction: None
- Consequences: Gain Privileges
The affected products:
- SolarWinds Database Performance Analyzer.
- SolarWinds Observability Self-Hosted.
- SolarWinds Serv-U.
Vulnerabilities
Mitigations
The enterprise should deploy this patch as soon as the testing phase is completed.