EUVD-2026-46291
GHSA-9wqx-3624-p2v9
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Requires existing domain-admin privileges (PR:H) over the network with low complexity; escalation to system admin crosses an authorization boundary (S:C) yielding full control over the service and its data (C:H/I:H/A:H).
Primary rating from Vendor (SolarWinds).
CVSS VectorVendor: SolarWinds
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to escalate their user type to that of a system administrator. The impact is lower in Windows deployments.
AnalysisAI
Privilege escalation in SolarWinds Serv-U managed file transfer server allows an existing domain administrator to elevate their Serv-U account from a standard user type to a full system administrator, granting complete control over the file transfer service and its data. The flaw stems from missing authorization (CWE-862) and carries a CVSS 9.1 rating, driven by a scope change and high confidentiality, integrity, and availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to already possess Serv-U domain-administrator privileges (reflected as PR:H in the CVSS vector) - this is the exact, concrete prerequisite and the primary limiting factor. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are partially conflicting and warrant nuance. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has already obtained Serv-U domain-administrator credentials - whether a malicious insider or an adversary who phished/compromised a privileged operator account - invokes the vulnerable authorization path to reassign their own account's user type to system administrator. With full system-admin control they can reconfigure domains, create backdoor accounts, and access or exfiltrate all files transiting the MFT server. … |
| Remediation | Upgrade to the fixed Serv-U release identified in the vendor's 2026-3 release notes (https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_2026-3_release_notes.htm); patch available per vendor advisory, though an exact patched build number is not independently confirmed in the provided data - consult the SolarWinds advisory at https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28310 for the precise version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all SolarWinds Serv-U deployments and identify systems granting domain administrator access; review Serv-U audit logs for privilege escalation or unauthorized account elevation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote denial-of-service in SolarWinds Serv-U allows unauthenticated attackers to crash the Serv-U service by sending sp
Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Mem
SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive fil
In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files (that include users' pas
A denial of service vulnerability in SolarWinds Serv-U before 15.1.6 HFv1 allows an authenticated user to crash the appl
Share/IncomingWizard.htm in SolarWinds Serv-U before 15.2.3 mishandles the user-supplied SenderEmail parameter, aka "Sha
Privilege escalation in SolarWinds Serv-U allows an authenticated domain administrator account to abuse an insecure dire
Privilege-scoped remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct o
Privilege-to-root remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct
Remote code execution in SolarWinds Serv-U managed file transfer/FTP server allows an attacker to run arbitrary code rem
Privilege escalation to remote code execution as root in SolarWinds Serv-U stems from an insecure direct object referenc
Account takeover in SolarWinds Serv-U managed file transfer server lets an authenticated user access and hijack other us
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today