EUVD-2026-46288
GHSA-6wjq-vfxv-86f5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain valid domain user credentials
-
DeliveryAuthenticate to Serv-U as domain group member
-
ExploitAbuse improper group-to-role mapping
-
ExecutionElevate into administrator group
-
ImpactControl file transfers and configuration
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to be an authenticated member of a domain user group that is trusted by the Serv-U instance, and the Serv-U deployment must be configured to use domain/directory group-based authorization - the improper elevation is from that domain user group into the administrator group. Limiting factors: valid domain credentials are needed (not a pre-auth flaw), the target must integrate with the affected directory-group configuration rather than only local Serv-U accounts, and SolarWinds explicitly states the impact is LOWER on Windows deployments, so Windows-hosted instances are less severely affected than non-Windows or other deployment modes. No user interaction is required, and the management surface is network-reachable. |
| Impact | The vendor CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H = 9.1) signals a network-reachable, low-complexity attack with a scope change and total impact, but PR:H is inconsistent with a description that only requires membership in a domain user group - an ordinary authenticated user is low-privileged, so real-world privilege requirements may be lower (PR:L) and effective severity higher; verify the exact required privilege level with SolarWinds. No EPSS score, KEV entry, or public POC is present in the provided data, so despite the high CVSS this is not currently evidenced as widely exploited. The realistic priority is elevated because Serv-U is an internet-facing MFT product historically targeted by attackers, but exploitation still requires valid domain credentials, which limits opportunistic mass abuse compared to a pre-auth flaw. |
| Exploit ScenarioDerived | An attacker who holds or phishes valid credentials for an ordinary domain user account authenticates to a Serv-U instance that trusts the corresponding domain user group; because the group is improperly mapped, the account is treated as a Serv-U administrator. With administrative control the attacker can read, modify, or exfiltrate all files in transit, alter server configuration, and pivot into connected systems. No public exploit code is identified at time of analysis, and low attack complexity means the elevation is reliable once suitable domain credentials are obtained. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 21, 2026
Privilege escalation in SolarWinds Serv-U allows an authenticated member of a domain user group to be elevated into an administrator group, granting full administrative control over the managed file transfer server. The flaw stems from improper access control (CWE-284) and carries a vendor CVSS of 9.1 due to a scope change and full confidentiality, integrity, and availability impact, though SolarWinds notes the impact is lower on Windows deployments. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
Upgrade to SolarWinds Serv-U 2026.3, which per the referenced release notes contains the fix; treat this as the primary remediation (Patch available per vendor advisory - exact prior affected versions not enumerated in the input). Consult the vendor advisory at https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28307 and the release notes at https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_2026-3_release_notes.htm for version-specific guidance. Until patched, restrict which domain user groups are granted any Serv-U access and audit group-to-role mappings to ensure no ordinary domain group can resolve to an administrator role; tighten membership of privileged directory groups and, where feasible, place the Serv-U management interface behind network access controls or a VPN so only trusted hosts can reach it - trade-offs include added authentication friction for legitimate administrators and possible disruption to automated file-transfer clients that connect from restricted networks.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SolarWinds Serv-U is a widely used managed file transfer (MFT) and FTP/FTPS/SFTP/HTTPS server that commonly integrates with directory services such as Active Directory / LDAP for user authentication and group-based authorization. The root cause is classified as CWE-284 (Improper Access Control): the mapping between domain user groups and Serv-U's internal authorization roles is enforced incorrectly, permitting a domain user group to cross a trust boundary into the administrator group. The single CPE, cpe:2.3:a:solarwinds:serv-u, confirms the application itself (not a specific OS component) is the affected product, and the vendor's note that impact is lower on Windows indicates the group-to-role elevation behaves differently - likely more severely - in non-Windows or externally-authenticated deployments.
Know when Serv U gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Network-reachable with valid but low-privileged domain-user credentials (PR:L, contra vendor PR:H), low complexity, and elevation into admin crosses a trust boundary (S:C) yielding full C/I/A impact.
Primary rating from Vendor (SolarWinds).
CVSS VectorVendor: SolarWinds
DescriptionCVE.org
SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain user group to be elevated into an administrator group. The impact is lower in Windows deployments.
Executive ViewAI
SolarWinds Serv-U deployments are vulnerable to privilege escalation that allows authenticated domain users to gain complete administrative control of file transfer servers. This creates critical risk for any organization relying on Serv-U for handling sensitive data transfers, exposing operations to data theft, unauthorized access, and service disruption. Immediate mitigation is required given the lack of an available patch.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict administrative access through network segmentation and firewall rules; implement multi-factor authentication for all privileged administrative accounts; enforce principle of least privilege by minimizing domain group memberships with administrative rights; monitor administrative activity logs continuously for unauthorized privilege escalation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Remote denial-of-service in SolarWinds Serv-U allows unauthenticated attackers to crash the Serv-U service by sending sp
Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Mem
SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive fil
In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files (that include users' pas
FTP Voyager 16.2.0 contains a denial of service vulnerability that allows local attackers to crash the application by in
A denial of service vulnerability in SolarWinds Serv-U before 15.1.6 HFv1 allows an authenticated user to crash the appl
Share/IncomingWizard.htm in SolarWinds Serv-U before 15.2.3 mishandles the user-supplied SenderEmail parameter, aka "Sha
Privilege escalation in SolarWinds Serv-U allows an authenticated domain administrator account to abuse an insecure dire
Privilege-scoped remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct o
Privilege-to-root remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct
Remote code execution in SolarWinds Serv-U managed file transfer/FTP server allows an attacker to run arbitrary code rem
Privilege escalation to remote code execution as root in SolarWinds Serv-U stems from an insecure direct object referenc
Exploit-DB