EUVD-2026-46293
GHSA-wpw8-5vq9-3rp5
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Network-reachable, low-complexity IDOR needing only a valid authenticated account (PR:L, not PR:H) to hijack another user's email flow, crossing an authorization boundary (S:C) for full account takeover.
Primary rating from Vendor (SolarWinds).
CVSS VectorVendor: SolarWinds
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to SMTP hijacking leading to arbitrary account takeover. The impact is lower in Windows deployments.
AnalysisAI
Account takeover in SolarWinds Serv-U is enabled by an insecure direct object reference (IDOR) that lets an authenticated user hijack the SMTP/email flow and seize arbitrary accounts, per SolarWinds' own advisory. Because the flaw crosses a trust boundary (CVSS scope-changed) with high confidentiality, integrity, and availability impact, a single privileged account can be leveraged against other users' accounts; Windows deployments are described by the vendor as lower-impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated, privileged Serv-U session per the CVSS PR:H metric, plus network reachability to the Serv-U interface (AV:N), and hinges on the SMTP/email account workflow being in use - the IDOR abuses the email-notification/account object to redirect messages and take over another account. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) reflects a network-reachable, low-complexity flaw with a scope change and full CIA impact, but it critically requires high privileges (PR:H) - meaning the attacker must already hold a privileged Serv-U account, which sharply narrows the realistic attacker population versus an unauthenticated bug. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker holding a privileged Serv-U account (or one they have compromised) sends a crafted request manipulating an account/email object identifier to redirect SMTP-driven messages - such as password-reset or notification email - for a targeted victim account. By capturing that email flow, the attacker completes a password reset or otherwise seizes control of the victim's account and its file access. … |
| Remediation | Patch available per vendor advisory: upgrade Serv-U to the 2026-3 release, which the SolarWinds release notes (https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_2026-3_release_notes.htm) identify as the fixed build; confirm the exact fixed build number against that page before deployment, and see the advisory at https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28313. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Immediately restrict administrative access to SolarWinds Serv-U to essential personnel and enforce multi-factor authentication on all administrative accounts, while auditing logs within 24 hours for unauthorized account changes or SMTP configuration modifications. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote denial-of-service in SolarWinds Serv-U allows unauthenticated attackers to crash the Serv-U service by sending sp
Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Mem
SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive fil
In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files (that include users' pas
A denial of service vulnerability in SolarWinds Serv-U before 15.1.6 HFv1 allows an authenticated user to crash the appl
Share/IncomingWizard.htm in SolarWinds Serv-U before 15.2.3 mishandles the user-supplied SenderEmail parameter, aka "Sha
Privilege escalation in SolarWinds Serv-U allows an authenticated domain administrator account to abuse an insecure dire
Privilege-scoped remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct o
Privilege-to-root remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct
Remote code execution in SolarWinds Serv-U managed file transfer/FTP server allows an attacker to run arbitrary code rem
Privilege escalation to remote code execution as root in SolarWinds Serv-U stems from an insecure direct object referenc
Account takeover in SolarWinds Serv-U managed file transfer server lets an authenticated user access and hijack other us
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today