EUVD-2026-46289
GHSA-hjp7-x3qv-vqf3
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Network-reachable admin interface (AV:N/AC:L) but requires domain administrator privileges (PR:H); IDOR-to-RCE escaping the domain boundary justifies S:C with full C/I/A impact.
Primary rating from Vendor (SolarWinds).
CVSS VectorVendor: SolarWinds
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution. Domain administrator access is required. The impact is lower in Windows deployments.
AnalysisAI
Privilege-scoped remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct object reference that lets an authenticated domain administrator reference objects outside their intended authorization boundary to run code on the host. The flaw carries a 9.1 CVSS due to network reach, scope change, and full confidentiality/integrity/availability impact, though the practical bar is high because domain administrator access is a prerequisite, and impact is reduced on Windows deployments. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated Serv-U domain administrator account (CVSS PR:H) reachable over the network (AV:N), with low attack complexity and no user interaction once that access is held; it is fundamentally an insider or post-credential-compromise attack, not remote-unauthenticated. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are mixed and should be read carefully. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained or been granted Serv-U domain administrator credentials logs into the management interface and manipulates a user-controlled object identifier to reference a resource or code path outside their assigned domain, chaining the IDOR into arbitrary code execution on the underlying server. Because the CVSS scope is changed, successful execution can affect resources beyond the vulnerable component, enabling lateral movement - most severely on Linux hosts, with reduced impact on Windows. … |
| Remediation | Upgrade Serv-U to the fixed build shipped in the SolarWinds Serv-U 2026-3 release as described in the release notes (https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_2026-3_release_notes.htm) and cross-referenced in the advisory (https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28308); the exact patched version string is not stated in the provided input, so validate the target build against those pages before rollout. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all SolarWinds Serv-U deployments in your environment, document current versions and operating system distribution (Windows vs. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote denial-of-service in SolarWinds Serv-U allows unauthenticated attackers to crash the Serv-U service by sending sp
Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Mem
SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive fil
In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files (that include users' pas
A denial of service vulnerability in SolarWinds Serv-U before 15.1.6 HFv1 allows an authenticated user to crash the appl
Share/IncomingWizard.htm in SolarWinds Serv-U before 15.2.3 mishandles the user-supplied SenderEmail parameter, aka "Sha
Privilege escalation in SolarWinds Serv-U allows an authenticated domain administrator account to abuse an insecure dire
Privilege-to-root remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct
Remote code execution in SolarWinds Serv-U managed file transfer/FTP server allows an attacker to run arbitrary code rem
Privilege escalation to remote code execution as root in SolarWinds Serv-U stems from an insecure direct object referenc
Account takeover in SolarWinds Serv-U managed file transfer server lets an authenticated user access and hijack other us
Privilege escalation to root/code execution in SolarWinds Serv-U (managed/secure file transfer server) arises from a bro
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today