EUVD-2026-46290
GHSA-vv5r-rfhv-vx6x
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Requires pre-existing domain admin (PR:H) over the network with no user interaction; creating a Serv-U system admin crosses an authorization boundary (S:C) yielding full C/I/A over the platform.
Primary rating from Vendor (SolarWinds).
CVSS VectorVendor: SolarWinds
Lifecycle Timeline
2DescriptionCVE.org
SolarWinds Serv-U is affected by a broken access control vulnerability that allows a domain administrator to create system administrator accounts. The impact is lower in Windows deployments.
AnalysisAI
Privilege escalation in SolarWinds Serv-U managed file transfer allows a user holding domain administrator privileges to create Serv-U system administrator accounts, crossing an authorization boundary the product is expected to enforce independently. Tracked as CVE-2026-28309 (CWE-862, Missing Authorization) and reported by SolarWinds, it carries a 9.1 CVSS due to scope change and full C/I/A impact, though the vendor notes the impact is lower in Windows deployments. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
Serv-U is SolarWinds' managed file transfer (MFT) and secure file server product (CPE cpe:2.3:a:solarwinds:serv-u), commonly fronting FTP/FTPS/SFTP/HTTPS file exchange for enterprises. The root cause is CWE-862 Missing Authorization: the account-provisioning logic conflates an external directory role (domain administrator) with the application's own privileged role (Serv-U system administrator), so a domain admin identity is permitted to mint top-tier Serv-U admin accounts without a separate authorization check inside the product. This is an access-control/authentication-bypass flaw (per the vendor tags 'Authentication Bypass', 'Serv U', 'Microsoft') rather than a memory-safety or injection bug; the trust boundary between directory-level administration and application-level administration is not properly segregated. The vendor's note that impact is 'lower in Windows deployments' suggests platform-specific differences in how domain accounts map to Serv-U privileges.
RemediationAI
Upgrade to the fixed Serv-U 2026-3 release, which is the version referenced in the vendor release notes (https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_2026-3_release_notes.htm); confirm the exact patched build against the SolarWinds security advisory at https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28309. Because exploitation requires domain administrator privileges, the strongest compensating control until patching is to tightly restrict and monitor domain admin group membership and to decouple Serv-U system-administrator provisioning from domain-admin identities - review and prune existing Serv-U system administrator accounts, and audit account-creation events for unexpected new admins (trade-off: added administrative overhead and possible disruption to automated provisioning). Where feasible, limit which directory groups are trusted for Serv-U administrative mapping and enable logging/alerting on privileged account creation. No effective network-layer workaround exists because the flaw is in application authorization logic, not a specific port or endpoint, so patching is the durable fix.
Remote denial-of-service in SolarWinds Serv-U allows unauthenticated attackers to crash the Serv-U service by sending sp
Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Mem
SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive fil
In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files (that include users' pas
FTP Voyager 16.2.0 contains a denial of service vulnerability that allows local attackers to crash the application by in
A denial of service vulnerability in SolarWinds Serv-U before 15.1.6 HFv1 allows an authenticated user to crash the appl
Share/IncomingWizard.htm in SolarWinds Serv-U before 15.2.3 mishandles the user-supplied SenderEmail parameter, aka "Sha
Privilege escalation in SolarWinds Serv-U allows an authenticated domain administrator account to abuse an insecure dire
Privilege-scoped remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct o
Privilege-to-root remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct
Remote code execution in SolarWinds Serv-U managed file transfer/FTP server allows an attacker to run arbitrary code rem
Privilege escalation to remote code execution as root in SolarWinds Serv-U stems from an insecure direct object referenc
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today