SolarWinds Serv-U CVE-2026-28315

The attacker must already hold a high-privilege administrator account on the SolarWinds Serv-U instance (PR:H per the CVSS vector) sufficient to write data into the field containing the stored XSS payload. A second administrator must then actively browse to the affected interface element (UI:R), triggering script execution in their browser. Exploitation is therefore limited to insider-threat scenarios, compromised admin credential chains, or environments where multiple admin accounts exist with differing trust levels. Default-configuration deployments are not exploitable by unauthenticated or low-privilege external attackers. The scope is limited to confidentiality (C:H) with no integrity or availability impact - the attacker gains session-level access, not the ability to modify server data or cause downtime directly.

The CVSS base score of 6.2 reflects a meaningful but bounded risk profile. The vector AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N confirms network delivery with no complexity barrier, but critically requires the attacker to hold high administrative privileges to plant the payload, and a separate administrator must then interact with the poisoned interface element. This significantly constrains the realistic attacker population - the most plausible threat actor is a lower-trust admin or compromised admin account escalating impact against a higher-trust peer, or an insider threat. No EPSS data was provided in the input; no KEV listing is present, meaning active exploitation is not confirmed by CISA. No public proof-of-concept has been identified at time of analysis. Despite the High confidentiality rating, the I:N and A:N components mean the vulnerability cannot directly modify data or cause downtime - its value to an attacker is credential or session pivot, not immediate destructive capability. Priority should be moderate: patch promptly but it does not displace actively-exploited critical vulnerabilities in triaging.

An attacker who has compromised or legitimately holds a high-privilege Serv-U administrator account injects a JavaScript payload into a field that is stored by the application and rendered in the administrative interface - for example, a filename, user comment, or configuration label. When a peer administrator subsequently navigates to the affected view, their browser executes the script, which reads the administrator's session cookie and exfiltrates it to an attacker-controlled endpoint. The attacker replays the stolen session token to fully impersonate the victim administrator without needing their credentials. No public proof-of-concept has been identified at time of analysis.