EUVD-2026-46292
GHSA-3r39-m2vf-jxmp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged Serv-U group user
-
DeliverySend crafted request abusing authorization check
-
ExploitElevate group access to system administrator
-
ExecutionExecute code as root on Linux/Unix host
-
ImpactFull server and file-transfer data compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization verification
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already hold a valid authenticated Serv-U account belonging to a group (CVSS PR:H, an authenticated prerequisite) plus network reachability to the Serv-U service (AV:N); no user interaction is needed (UI:N) and attack complexity is low (AC:L). The chief limiting factor is that this is a post-authentication escalation rather than a pre-auth compromise, so the attacker must first obtain credentials or an account. Impact is maximal only on non-Windows (Linux/Unix) deployments where the escalation produces code execution as root; the vendor explicitly notes lower impact on Windows, which limits real-world severity on that platform. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H = 9.1) reflects network reach, low complexity, no user interaction, a scope change, and full CIA impact, but it requires existing privileges (PR:H per the vendor), making this a post-authentication escalation primitive rather than a pre-auth breach. No EPSS score, POC, or KEV listing was provided, so exploitation currently appears theoretical or targeted rather than widespread. A tension worth flagging: the vendor's PR:H seems conservative given the description frames it as elevating an ordinary group's access, which arguably implies a lower starting privilege (PR:L) and a broader attacker population - verify the exact required privilege with SolarWinds. Overall this is a genuine high-priority patch for internet-exposed or multi-tenant Serv-U instances since post-auth RCE-as-root is severe, but the authentication prerequisite meaningfully limits opportunistic mass exploitation. |
| Exploit ScenarioDerived | An attacker holding a low-privileged Serv-U group account - for example a customer or partner login on a file-transfer portal - sends crafted network requests that abuse the flawed authorization check to promote their group's access to system administrator. On a Linux/Unix host this yields code execution as root, allowing them to read all transferred files, alter configuration, and fully compromise the server. No public exploit code has been identified at time of analysis, and no user interaction is required. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 21, 2026
Privilege escalation in SolarWinds Serv-U lets an authenticated group member elevate their access to system administrator and execute code as root on Linux/Unix deployments, with reduced impact on Windows. The root cause is improper authorization (CWE-285) reachable over the network; the vendor rates it CVSS 9.1 due to a scope change and full CIA impact, but there is no public exploit identified at time of analysis and it is not in CISA KEV. Fixed in the Serv-U 2026-3 release.
RemediationAI
Upgrade to SolarWinds Serv-U 2026-3, which contains the fix (Vendor-released patch: Serv-U 2026-3); consult the release notes at https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_2026-3_release_notes.htm and the advisory at https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28312 for exact build numbers. Until patching, shrink the attacker population by auditing existing group memberships and administrator assignments and removing unnecessary user accounts, since exploitation requires an authenticated foothold. Restrict network exposure of the Serv-U management and service interfaces to trusted networks or a VPN rather than the public internet (trade-off: disrupts remote admin/file-transfer workflows), and prioritize patching Linux/Unix hosts first because that is where the outcome is root-level code execution, per the vendor's own note that Windows impact is lower.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SolarWinds Serv-U is a managed file transfer (MFT) server supporting FTP/FTPS/SFTP and HTTP(S) that administers users, groups, and domains. The flaw is CWE-285 (Improper Authorization): Serv-U fails to correctly enforce the authorization boundary between an ordinary group's privileges and the system administrator role, allowing a group's effective access to be promoted to administrator. Because the Serv-U service on Linux/Unix runs with high OS privilege, that escalation becomes code execution as root; the Windows service privilege model constrains the outcome, which is why the vendor notes lower impact there. The affected CPE is cpe:2.3:a:solarwinds:serv-u:*:*:*:*:*:*:*:*, i.e. the Serv-U application in versions prior to the 2026-3 fix.
Know when Serv U gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Description frames it as elevating an ordinary group's access, implying an authenticated low-privileged account (PR:L) that gains root via a scope-changing authorization flaw with full CIA impact.
Primary rating from Vendor (SolarWinds).
CVSS VectorVendor: SolarWinds
DescriptionCVE.org
SolarWinds Serv-U is affected by a privilege escalation vulnerability. This would elevate a group’s access to system administrator and allow code execution as root. The impact is lower in Windows deployments.
Executive ViewAI
SolarWinds Serv-U contains a critical privilege escalation flaw (CVE-2026-28312, CVSS 9.1) allowing authenticated users to gain root access and execute arbitrary code on Linux/Unix systems; no public exploit identified at time of analysis. Any user account with Serv-U access becomes a vehicle for complete system compromise. Vendor-released patch: Serv-U 2026-3 requires immediate deployment across all deployments.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Remote denial-of-service in SolarWinds Serv-U allows unauthenticated attackers to crash the Serv-U service by sending sp
Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Mem
SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive fil
In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files (that include users' pas
FTP Voyager 16.2.0 contains a denial of service vulnerability that allows local attackers to crash the application by in
A denial of service vulnerability in SolarWinds Serv-U before 15.1.6 HFv1 allows an authenticated user to crash the appl
Share/IncomingWizard.htm in SolarWinds Serv-U before 15.2.3 mishandles the user-supplied SenderEmail parameter, aka "Sha
Privilege escalation in SolarWinds Serv-U allows an authenticated domain administrator account to abuse an insecure dire
Privilege-scoped remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct o
Privilege-to-root remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct
Remote code execution in SolarWinds Serv-U managed file transfer/FTP server allows an attacker to run arbitrary code rem
Privilege escalation to remote code execution as root in SolarWinds Serv-U stems from an insecure direct object referenc
Exploit-DB