The same release cycle resolves a critical SAML authentication bypass in Web Help Desk (CVE-2026-28323, 9.8) that applies when SAML 2.0 authentication is enabled, plus a denial-of-service flaw in the same product (CVE-2026-28299, 8.2), and 16 flaws in Serv-U (CVE-2026-28302, CVE-2026-28304 through CVE-2026-28317, CVE-2026-28321 and CVE-2026-28323) that could enable privilege escalation, remote code execution and the creation of administrator accounts.

NVD description

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation. This issue requires domain administrator access. The impact is lower in Windows deployments.