CVE-2026-28315 is a stored cross-site scripting (CWE-79) vulnerability in SolarWinds Serv-U. It arises from improper neutralization of input during web page generation, enabling an attacker to inject malicious scripts that execute in the context of an administrator user. This can result in session hijacking or information disclosure. The CVSS 3.1 base score is 6.2 (medium severity) with network attack vector, low attack complexity, requiring high privileges and user interaction, and impacts confidentiality with a scope change.

Successful exploitation could allow an attacker with high privileges and user interaction to hijack administrator sessions or disclose sensitive information accessible to the administrator. The vulnerability affects confidentiality but not integrity or availability. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, administrators should monitor SolarWinds advisories for updates. Until a patch is available, limiting administrator exposure to untrusted input and exercising caution with user-generated content may reduce risk.