Skip to main content
A Singapore Government Agency Website How to identify
Official website links end with .gov.sg
Government agencies communicate via .gov.sg websites (e.g. go.gov.sg/open). Trusted websites
Secure websites use HTTPS
Look for a lock () or https:// as an added precaution. Share sensitive information only on official, secure websites.

Government officials will never ask you to transfer money or disclose bank log-in details over a phone call.

Call the 24/7 ScamShield Helpline at 1799 if you are unsure if something is a scam.

Cyber Security Agency of Singapore
Alerts

Multiple Critical Vulnerabilities in SolarWinds Serv-U

23 July 2026

Attackers can exploit two critical vulnerabilities in SolarWinds Serv-U to perform remote code execution. Patch immediately.

Background

SolarWinds has released security updates to address two vulnerabilities (CVE-2026-28304 and CVE-2026-28311) affecting SolarWinds Serv-U. SolarWinds Serv-U is a multi-protocol file server capable of sending and receiving files from other networked computers.

These vulnerabilities have a Common Vulnerability Scoring System (CVSS v3.1) score of 9.1 out of 10.

Impact

Successful exploitation of these vulnerabilities could lead to the following:

  • CVE-2026-28304: A remote code execution vulnerability that can allow an attacker to execute arbitrary code as root.

  • CVE-2026-28311: A remote code execution vulnerability that can allow a domain administrator to modify how the application behaves and perform remote code execution.

Affected Products

These vulnerabilities affect SolarWinds Serv-U versions 15.5.4 HF1 and below.

Recommendations

Users and administrators of affected products are advised to update to the latest versions immediately.

References

https://www.solarwinds.com/trust-center/security-advisories/cve-2026-28304

https://www.solarwinds.com/trust-center/security-advisories/cve-2026-28311

Back to top