SolarWinds Serv-U CVE-2026-28310

Exploitation requires the attacker to already possess Serv-U domain-administrator privileges (reflected as PR:H in the CVSS vector) - this is the exact, concrete prerequisite and the primary limiting factor. From that position the attacker escalates their account's user type to system administrator via the missing-authorization flaw; no user interaction (UI:N) and low complexity (AC:L) are needed. Limiting factors that reduce realistic risk: the domain-admin credential gate means this cannot be exploited by anonymous or low-privileged users, and SolarWinds explicitly states the impact is LOWER on Windows deployments, so platform is a material limiter. The 'Authentication Bypass' tag is not consistent with the PR:H requirement and should be verified against the vendor advisory rather than treated as a true unauthenticated bypass.

The signals are partially conflicting and warrant nuance. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, score 9.1) is dominated by the scope change and full CIA impact, but the PR:H metric confirms this is NOT an unauthenticated flaw - the attacker must already hold Serv-U domain-administrator privileges, a substantial pre-condition that sharply narrows the realistic threat population to insiders or attackers who have already compromised a privileged domain-admin account. No EPSS score, no CISA KEV listing, and no POC were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The 'Authentication Bypass' tag conflicts with the PR:H vector, which describes privilege escalation from an already-authenticated high-privilege position rather than a true auth bypass - treat the tag with caution and verify with the vendor. SolarWinds' own note that impact is lower on Windows deployments further suggests real-world severity is platform-dependent and likely below the raw 9.1 headline for many environments. Net: high nominal severity, but the PR:H gate makes this a privileged-insider/post-compromise escalation issue rather than a mass-exploitable remote threat.

An attacker who has already obtained Serv-U domain-administrator credentials - whether a malicious insider or an adversary who phished/compromised a privileged operator account - invokes the vulnerable authorization path to reassign their own account's user type to system administrator. With full system-admin control they can reconfigure domains, create backdoor accounts, and access or exfiltrate all files transiting the MFT server. No public POC is available at time of analysis, and the low attack complexity (AC:L) means the escalation is straightforward once the domain-admin prerequisite is met.