EUVD-2026-46287
GHSA-crvr-7853-c944
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Requires pre-existing domain-admin access so PR:H; network-reachable low-complexity escalation crossing into the Serv-U admin plane (S:C) yields full C/I/A control.
Primary rating from Vendor (SolarWinds).
CVSS VectorVendor: SolarWinds
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to elevate their privileges to a system administrator. The impact is lower in Windows deployments.
AnalysisAI
Privilege escalation in SolarWinds Serv-U allows a domain administrator to elevate to a full Serv-U system administrator, granting complete control over the managed file transfer server and its data (CVSS 9.1, CWE-284 improper access control). Exploitation requires existing domain-administrator privileges (PR:H) but no user interaction, and the vendor notes the impact is reduced on Windows deployments, implying non-Windows (Linux) installs are more severely affected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to already possess domain-administrator privileges (CVSS PR:H) on the environment integrated with Serv-U - this is the primary limiting factor and confirms the flaw is a post-compromise or malicious-insider escalation, not an unauthenticated remote takeover. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The raw CVSS 9.1 is driven by network vector (AV:N), low complexity (AC:L), no user interaction (UI:N), scope change (S:C) and full C/I/A impact - but PR:H is the decisive limiter: the attacker must already hold domain-administrator rights, a very high bar that means this is primarily an insider or post-compromise escalation issue rather than a mass-exploitable perimeter flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has already obtained domain-administrator credentials (for example via prior phishing or credential theft) authenticates to a Serv-U server and abuses the improper access-control gap to promote their domain-admin identity into a full Serv-U system administrator. From there they gain complete control over the file transfer service, enabling theft or tampering of all transferred files and configuration. … |
| Remediation | Vendor-released patch: upgrade to SolarWinds Serv-U 2026.3, which is referenced in the vendor's release notes as the remediated build; apply it per the advisory at https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28306 and https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_2026-3_release_notes.htm. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct a complete inventory of Serv-U deployments by version and operating system, and document which systems permit domain administrator access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote denial-of-service in SolarWinds Serv-U allows unauthenticated attackers to crash the Serv-U service by sending sp
Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Mem
SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive fil
In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files (that include users' pas
A denial of service vulnerability in SolarWinds Serv-U before 15.1.6 HFv1 allows an authenticated user to crash the appl
Share/IncomingWizard.htm in SolarWinds Serv-U before 15.2.3 mishandles the user-supplied SenderEmail parameter, aka "Sha
Privilege escalation in SolarWinds Serv-U allows an authenticated domain administrator account to abuse an insecure dire
Privilege-scoped remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct o
Privilege-to-root remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct
Remote code execution in SolarWinds Serv-U managed file transfer/FTP server allows an attacker to run arbitrary code rem
Privilege escalation to remote code execution as root in SolarWinds Serv-U stems from an insecure direct object referenc
Account takeover in SolarWinds Serv-U managed file transfer server lets an authenticated user access and hijack other us
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today