EUVD-2026-46285
GHSA-2737-hj93-8fjw
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Network-reachable, low-complexity RCE with scope change (root beyond app); PR:L chosen because the auth-bypass tag and CWE-284 undercut the input's PR:H, though this remains unresolved.
Primary rating from Vendor (SolarWinds).
CVSS VectorVendor: SolarWinds
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
SolarWinds Serv-U is affected by a remote code execution vulnerability that, when exploited, can allow the arbitrary execution of code remotely as root. The impact is lower in Windows deployments.
AnalysisAI
Remote code execution in SolarWinds Serv-U managed file transfer/FTP server allows an attacker to run arbitrary code remotely, executing as root on Unix/Linux deployments while impact is reduced on Windows. The flaw stems from an access-control weakness (CWE-284) and is corroborated by a vendor 'Authentication Bypass' tag, carrying a CVSS 9.1 (scope-changed) rating. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the Serv-U service (AV:N, AC:L, no user interaction). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are mixed and partly contradictory, which teams should weigh carefully. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can reach the Serv-U service over the network abuses the improper access-control / authentication-bypass flaw to submit a crafted request that is processed with insufficient authorization checks, causing arbitrary code to execute in the Serv-U process context - as root on a Linux host. On Unix/Linux this results in full host compromise; on Windows the attacker gains code execution at lower privilege. … |
| Remediation | Upgrade to SolarWinds Serv-U 2026-3, which contains the fix per the release notes (https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_2026-3_release_notes.htm); review the vendor advisory at https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28304 for the exact fixed build before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Immediately identify and catalog all SolarWinds Serv-U instances in your environment; restrict network access to internal networks only and disable all external connections and unauthenticated pathways. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote denial-of-service in SolarWinds Serv-U allows unauthenticated attackers to crash the Serv-U service by sending sp
Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Mem
SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive fil
In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files (that include users' pas
A denial of service vulnerability in SolarWinds Serv-U before 15.1.6 HFv1 allows an authenticated user to crash the appl
Share/IncomingWizard.htm in SolarWinds Serv-U before 15.2.3 mishandles the user-supplied SenderEmail parameter, aka "Sha
Privilege escalation in SolarWinds Serv-U allows an authenticated domain administrator account to abuse an insecure dire
Privilege-scoped remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct o
Privilege-to-root remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct
Privilege escalation to remote code execution as root in SolarWinds Serv-U stems from an insecure direct object referenc
Account takeover in SolarWinds Serv-U managed file transfer server lets an authenticated user access and hijack other us
Privilege escalation to root/code execution in SolarWinds Serv-U (managed/secure file transfer server) arises from a bro
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today