SolarWinds Serv-U CVE-2026-28305

Exploitation requires a domain account that already holds Serv-U administrative privileges plus read and write access to the home directory - these are the exact prerequisites stated in the description, meaning this is not exploitable against a default unprivileged or anonymous session. The attack is network-reachable (AV:N) and low-complexity (AC:L) once those privileges are held, and requires no user interaction (UI:N). Key limiting factors: the high privilege requirement (PR:H) gates the vulnerability to admin-level principals, and the platform matters - Linux yields root-level RCE while Windows deployments are explicitly lower impact, so Windows environments face a reduced but not clearly quantified consequence.

The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) drives the 9.1 score, but the single most important signal is PR:H - exploitation requires an already-privileged domain account with admin rights and read/write access to the home directory, so this is not an unauthenticated internet-facing takeover. The high base score is largely a product of the scope change (S:C) capturing privilege escalation from app-admin to OS root. No EPSS score was provided, the CVE is not in CISA KEV, and no POC is referenced, so all three exploitation-likelihood signals are either absent or negative; realistic risk is that of a post-authentication privilege-escalation primitive useful to an insider or an attacker who has already compromised admin credentials. The description states impact is lower on Windows, which conflicts with the single blanket C:H/I:H/A:H vector - verify platform-specific severity with the vendor advisory before treating Windows deployments as equally critical.

An attacker who has obtained (or an insider who holds) a domain account with Serv-U admin privileges and read/write access to the home directory manipulates an object reference exposed by the application to point at a filesystem path outside their intended authorization boundary. On a Linux host this is leveraged to write and trigger execution of attacker-controlled content as root, converting application-level administration into full operating-system compromise. No public POC is referenced, so exploitation currently presumes bespoke development against the IDOR flaw.