EUVD-2026-46292
GHSA-3r39-m2vf-jxmp
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Description frames it as elevating an ordinary group's access, implying an authenticated low-privileged account (PR:L) that gains root via a scope-changing authorization flaw with full CIA impact.
Primary rating from Vendor (SolarWinds).
CVSS VectorVendor: SolarWinds
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
SolarWinds Serv-U is affected by a privilege escalation vulnerability. This would elevate a group’s access to system administrator and allow code execution as root. The impact is lower in Windows deployments.
AnalysisAI
Privilege escalation in SolarWinds Serv-U lets an authenticated group member elevate their access to system administrator and execute code as root on Linux/Unix deployments, with reduced impact on Windows. The root cause is improper authorization (CWE-285) reachable over the network; the vendor rates it CVSS 9.1 due to a scope change and full CIA impact, but there is no public exploit identified at time of analysis and it is not in CISA KEV. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to already hold a valid authenticated Serv-U account belonging to a group (CVSS PR:H, an authenticated prerequisite) plus network reachability to the Serv-U service (AV:N); no user interaction is needed (UI:N) and attack complexity is low (AC:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H = 9.1) reflects network reach, low complexity, no user interaction, a scope change, and full CIA impact, but it requires existing privileges (PR:H per the vendor), making this a post-authentication escalation primitive rather than a pre-auth breach. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker holding a low-privileged Serv-U group account - for example a customer or partner login on a file-transfer portal - sends crafted network requests that abuse the flawed authorization check to promote their group's access to system administrator. On a Linux/Unix host this yields code execution as root, allowing them to read all transferred files, alter configuration, and fully compromise the server. … |
| Remediation | Upgrade to SolarWinds Serv-U 2026-3, which contains the fix (Vendor-released patch: Serv-U 2026-3); consult the release notes at https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_2026-3_release_notes.htm and the advisory at https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28312 for exact build numbers. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all SolarWinds Serv-U deployments, determine current versions, and document user access levels. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote denial-of-service in SolarWinds Serv-U allows unauthenticated attackers to crash the Serv-U service by sending sp
Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Mem
SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive fil
In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files (that include users' pas
A denial of service vulnerability in SolarWinds Serv-U before 15.1.6 HFv1 allows an authenticated user to crash the appl
Share/IncomingWizard.htm in SolarWinds Serv-U before 15.2.3 mishandles the user-supplied SenderEmail parameter, aka "Sha
Privilege escalation in SolarWinds Serv-U allows an authenticated domain administrator account to abuse an insecure dire
Privilege-scoped remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct o
Privilege-to-root remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct
Remote code execution in SolarWinds Serv-U managed file transfer/FTP server allows an attacker to run arbitrary code rem
Privilege escalation to remote code execution as root in SolarWinds Serv-U stems from an insecure direct object referenc
Account takeover in SolarWinds Serv-U managed file transfer server lets an authenticated user access and hijack other us
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today