What is the CVSS score of CVE-2026-28307?

CVE-2026-28307 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of SolarWinds Serv-U are affected by CVE-2026-28307?

SolarWinds Serv-U deployments are vulnerable to privilege escalation that allows authenticated domain users to gain complete administrative control of file transfer servers.

How to fix or mitigate CVE-2026-28307?

Within 24 hours, inventory all SolarWinds Serv-U instances and identify which domain user groups hold administrative privileges. Within 7 days, implement network segmentation to restrict administrative access to Serv-U from trusted networks only, enable multi-factor authentication for administrative accounts if supported, and audit user group memberships to enforce least-privilege principles. Within 30 days, establish monitoring of SolarWinds security advisories, create a testing environment for patch validation, and define a deployment schedule for when vendor patches become available.

SolarWinds Serv-U CVE-2026-28307

EUVD-2026-46288 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 SolarWinds

GHSA-6wjq-vfxv-86f5

Authentication Bypass Privilege Escalation Microsoft Serv U Solarwinds

9.1

CVSS 3.1 · Vendor: SolarWinds

Severity by source

Vendor (SolarWinds) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable with valid but low-privileged domain-user credentials (PR:L, contra vendor PR:H), low complexity, and elevation into admin crosses a trust boundary (S:C) yielding full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (SolarWinds).

CVSS VectorVendor: SolarWinds

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 16:16 vuln.today

CVE Published

Jul 21, 2026 - 15:34 cve.org

CRITICAL 9.1

DescriptionCVE.org

SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain user group to be elevated into an administrator group. The impact is lower in Windows deployments.

AnalysisAI

Privilege escalation in SolarWinds Serv-U allows an authenticated member of a domain user group to be elevated into an administrator group, granting full administrative control over the managed file transfer server. The flaw stems from improper access control (CWE-284) and carries a vendor CVSS of 9.1 due to a scope change and full confidentiality, integrity, and availability impact, though SolarWinds notes the impact is lower on Windows deployments. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

SolarWinds Serv-U is a widely used managed file transfer (MFT) and FTP/FTPS/SFTP/HTTPS server that commonly integrates with directory services such as Active Directory / LDAP for user authentication and group-based authorization. The root cause is classified as CWE-284 (Improper Access Control): the mapping between domain user groups and Serv-U's internal authorization roles is enforced incorrectly, permitting a domain user group to cross a trust boundary into the administrator group. The single CPE, cpe:2.3:a:solarwinds:serv-u, confirms the application itself (not a specific OS component) is the affected product, and the vendor's note that impact is lower on Windows indicates the group-to-role elevation behaves differently - likely more severely - in non-Windows or externally-authenticated deployments.

RemediationAI

Upgrade to SolarWinds Serv-U 2026.3, which per the referenced release notes contains the fix; treat this as the primary remediation (Patch available per vendor advisory - exact prior affected versions not enumerated in the input). Consult the vendor advisory at https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28307 and the release notes at https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_2026-3_release_notes.htm for version-specific guidance. Until patched, restrict which domain user groups are granted any Serv-U access and audit group-to-role mappings to ensure no ordinary domain group can resolve to an administrator role; tighten membership of privileged directory groups and, where feasible, place the Serv-U management interface behind network access controls or a VPN so only trusted hosts can reach it - trade-offs include added authentication friction for legitimate administrators and possible disruption to automated file-transfer clients that connect from restricted networks.