EUVD-2026-46287
GHSA-crvr-7853-c944
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain domain-admin credentials
-
DeliveryAuthenticate to Serv-U service
-
ExploitAbuse improper access control (CWE-284)
-
ExecutionElevate to Serv-U system administrator
-
ImpactControl MFT server and exfiltrate files
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already possess domain-administrator privileges (CVSS PR:H) on the environment integrated with Serv-U - this is the primary limiting factor and confirms the flaw is a post-compromise or malicious-insider escalation, not an unauthenticated remote takeover. No user interaction is required (UI:N) and the vector is network-reachable (AV:N) with low complexity (AC:L). A further limiting/qualifying condition stated by the vendor is deployment platform: impact is lower on Windows deployments, meaning non-Windows (e.g., Linux) Serv-U installations face the more severe outcome. Authentication is effectively at the domain-admin level per the CVSS vector. |
| Impact | The raw CVSS 9.1 is driven by network vector (AV:N), low complexity (AC:L), no user interaction (UI:N), scope change (S:C) and full C/I/A impact - but PR:H is the decisive limiter: the attacker must already hold domain-administrator rights, a very high bar that means this is primarily an insider or post-compromise escalation issue rather than a mass-exploitable perimeter flaw. No EPSS score was provided, the CVE is not in CISA KEV, and no public POC is referenced, so all three exploitation-probability signals point to low near-term real-world risk despite the critical score. No SSVC decision data was supplied. A notable caveat: the description states impact is lower on Windows, yet the single published vector does not differentiate platforms - defenders on Linux/non-Windows Serv-U should treat the impact as the worst case and verify platform-specific severity with SolarWinds. Given Serv-U's history as a targeted MFT product, patching is warranted even though this specific flaw needs pre-existing high privilege. |
| Exploit ScenarioDerived | An attacker who has already obtained domain-administrator credentials (for example via prior phishing or credential theft) authenticates to a Serv-U server and abuses the improper access-control gap to promote their domain-admin identity into a full Serv-U system administrator. From there they gain complete control over the file transfer service, enabling theft or tampering of all transferred files and configuration. No public exploit code is currently identified, and no user interaction is required once domain-admin access is held. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 21, 2026
Privilege escalation in SolarWinds Serv-U allows a domain administrator to elevate to a full Serv-U system administrator, granting complete control over the managed file transfer server and its data (CVSS 9.1, CWE-284 improper access control). Exploitation requires existing domain-administrator privileges (PR:H) but no user interaction, and the vendor notes the impact is reduced on Windows deployments, implying non-Windows (Linux) installs are more severely affected. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so this is a defense-in-depth priority rather than a confirmed active threat.
RemediationAI
Vendor-released patch: upgrade to SolarWinds Serv-U 2026.3, which is referenced in the vendor's release notes as the remediated build; apply it per the advisory at https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28306 and https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_2026-3_release_notes.htm. Because exploitation requires domain-administrator privileges, the strongest compensating control until patching is to tightly restrict and audit who holds domain-admin rights on hosts running Serv-U and to avoid co-locating Serv-U with domain controllers or shared domain-admin accounts (trade-off: administrative overhead and possible operational friction for existing admin workflows). Additionally, monitor Serv-U administrative-account creation and role changes for unexpected elevation to system administrator, and prioritize non-Windows/Linux Serv-U instances first given their higher stated impact. No standalone configuration workaround is documented, so upgrading remains the definitive fix.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SolarWinds Serv-U is an enterprise managed file transfer (MFT) and FTP/FTPS/SFTP/HTTPS server (cpe:2.3:a:solarwinds:serv-u:*) used to move files between organizations and internal systems. The root cause is classified as CWE-284 (Improper Access Control): Serv-U fails to correctly separate the authorization boundary between a domain-level administrator identity and the application's own 'system administrator' role, allowing a domain admin to cross into the higher Serv-U administrative tier. The CVSS scope-change flag (S:C) reflects that the compromise moves beyond the initially authorized component into control of the Serv-U management plane. The vendor's note that impact is 'lower in Windows deployments' suggests the underlying access-control gap interacts differently with the host OS privilege model, being more consequential on non-Windows installations.
Know when Serv U gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Requires pre-existing domain-admin access so PR:H; network-reachable low-complexity escalation crossing into the Serv-U admin plane (S:C) yields full C/I/A control.
Primary rating from Vendor (SolarWinds).
CVSS VectorVendor: SolarWinds
DescriptionCVE.org
SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to elevate their privileges to a system administrator. The impact is lower in Windows deployments.
Executive ViewAI
SolarWinds Serv-U contains a critical privilege escalation vulnerability (CVE-2026-28306, CVSS 9.1) enabling domain administrators to escalate to full system administrator access, with elevated risk on Linux deployments. No public exploit identified at time of analysis; however, the absence of a vendor patch creates an unacceptable control gap for this critical infrastructure. A single compromised domain administrator account could enable complete control of all managed file transfer operations and data.
No vendor-released patch identified at time of analysis. Interim mitigations include: (1) restrict domain administrator account access to Serv-U systems using network segmentation, firewall rules, or application-level access controls; (2) enforce multi-factor authentication for domain administrator credentials; (3) implement comprehensive logging and real-time monitoring of Serv-U administrative actions with automated alerts for privilege escalation attempts; (4) minimize the total number of domain administrator accounts through access review and principle-of-least-privilege enforcement; (5) apply enhanced network isolation to Linux-based Serv-U deployments given the elevated risk profile.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Remote denial-of-service in SolarWinds Serv-U allows unauthenticated attackers to crash the Serv-U service by sending sp
Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Mem
SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive fil
In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files (that include users' pas
FTP Voyager 16.2.0 contains a denial of service vulnerability that allows local attackers to crash the application by in
A denial of service vulnerability in SolarWinds Serv-U before 15.1.6 HFv1 allows an authenticated user to crash the appl
Share/IncomingWizard.htm in SolarWinds Serv-U before 15.2.3 mishandles the user-supplied SenderEmail parameter, aka "Sha
Privilege escalation in SolarWinds Serv-U allows an authenticated domain administrator account to abuse an insecure dire
Privilege-scoped remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct o
Privilege-to-root remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct
Remote code execution in SolarWinds Serv-U managed file transfer/FTP server allows an attacker to run arbitrary code rem
Privilege escalation to remote code execution as root in SolarWinds Serv-U stems from an insecure direct object referenc
Exploit-DB