EUVD-2026-46293
GHSA-wpw8-5vq9-3rp5
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Network-reachable, low-complexity IDOR needing only a valid authenticated account (PR:L, not PR:H) to hijack another user's email flow, crossing an authorization boundary (S:C) for full account takeover.
Primary rating from Vendor (SolarWinds).
CVSS VectorVendor: SolarWinds
Lifecycle Timeline
2DescriptionCVE.org
SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to SMTP hijacking leading to arbitrary account takeover. The impact is lower in Windows deployments.
AnalysisAI
Account takeover in SolarWinds Serv-U is enabled by an insecure direct object reference (IDOR) that lets an authenticated user hijack the SMTP/email flow and seize arbitrary accounts, per SolarWinds' own advisory. Because the flaw crosses a trust boundary (CVSS scope-changed) with high confidentiality, integrity, and availability impact, a single privileged account can be leveraged against other users' accounts; Windows deployments are described by the vendor as lower-impact. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Technical ContextAI
Serv-U is SolarWinds' managed file transfer (MFT) and secure FTP/HTTP/SFTP server used to move files across organizational boundaries. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key / IDOR): the application exposes an object identifier - here tied to the SMTP/email-based account workflow (e.g., password reset or notification routing) - without verifying that the requesting principal is authorized to act on that object. By substituting another user's identifier, an attacker redirects account-related email ('SMTP hijacking') and completes takeover. The CPE cpe:2.3:a:solarwinds:serv-u:*:*:*:*:*:*:*:* indicates Serv-U releases prior to the fixed 2026-3 build are potentially in scope, pending an explicit fixed-version confirmation from the vendor.
RemediationAI
Patch available per vendor advisory: upgrade Serv-U to the 2026-3 release, which the SolarWinds release notes (https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_2026-3_release_notes.htm) identify as the fixed build; confirm the exact fixed build number against that page before deployment, and see the advisory at https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28313. Until patched, reduce exposure by restricting administrative and web-portal access to trusted networks (place the Serv-U management/HTTP interface behind a VPN or IP allowlist), since exploitation requires an authenticated privileged account; prune and audit privileged Serv-U accounts to limit who can trigger the IDOR; and monitor SMTP/notification configuration changes and password-reset emails for anomalous redirection. Note that network access restrictions may impede legitimate remote administrators and should be paired with monitoring rather than treated as a permanent substitute for the fix.
Remote denial-of-service in SolarWinds Serv-U allows unauthenticated attackers to crash the Serv-U service by sending sp
Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Mem
SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive fil
In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files (that include users' pas
FTP Voyager 16.2.0 contains a denial of service vulnerability that allows local attackers to crash the application by in
A denial of service vulnerability in SolarWinds Serv-U before 15.1.6 HFv1 allows an authenticated user to crash the appl
Share/IncomingWizard.htm in SolarWinds Serv-U before 15.2.3 mishandles the user-supplied SenderEmail parameter, aka "Sha
Privilege escalation in SolarWinds Serv-U allows an authenticated domain administrator account to abuse an insecure dire
Privilege-scoped remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct o
Privilege-to-root remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct
Remote code execution in SolarWinds Serv-U managed file transfer/FTP server allows an attacker to run arbitrary code rem
Privilege escalation to remote code execution as root in SolarWinds Serv-U stems from an insecure direct object referenc
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today