SolarWinds Serv-U CVE-2026-28314

Exploitation requires a valid authenticated Serv-U session - per the CVSS vector (PR present) the attacker must already possess working credentials, so this is not an unauthenticated attack; the specific IDOR is triggered by manipulating a user-controlled object/account identifier in a request to the Serv-U service. Limiting factors: the attacker needs network reachability to the Serv-U interface and legitimate authentication to Serv-U, and the achievable impact is explicitly lower on Windows deployments than on non-Windows/Linux ones, so platform and account exposure meaningfully constrain real-world risk. Note the description says 'user authentication is required' (any user) while the supplied CVSS uses PR:H (high privilege) - this inconsistency should be confirmed with the vendor, as it determines whether a low-privileged user or only a privileged one can exploit it.

The CVSS 3.1 base score is 9.1 (Critical) with vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - network-reachable, low complexity, no user interaction, but requiring privileges (PR:H) and asserting a scope change with full CIA impact. The signals are somewhat mixed: the description states only that 'user authentication is required' (consistent with any authenticated user, i.e. PR:L), yet the provided vector uses PR:H and S:C, which inflates the score; this discrepancy should be verified with the vendor because it materially changes exploitability (a normal-user IDOR is far more dangerous than one needing high privilege). The vendor's note that impact is 'lower in Windows deployments' means real-world risk is platform-dependent - Linux/non-Windows installs carry the higher impact. No EPSS score, KEV listing, or POC was provided, so there is no evidence of active exploitation or public exploit code; this is a critical-by-CVSS issue whose weaponization status is currently unknown. Given Serv-U's role as an internet-facing file transfer product and SolarWinds' history of being an attacker target, it warrants prompt patching despite the absence of exploitation evidence.

An attacker who holds or obtains any valid Serv-U user credential logs in and issues a request that references another account's identifier (e.g. altering a user or object ID parameter), which the server honors without checking ownership, granting control over the victim account. On a Linux/non-Windows deployment this yields the fuller impact described, potentially cascading to takeover of higher-privileged or administrative accounts and the files they can access. No public exploit code has been identified, but the low attack complexity and lack of required user interaction make exploitation straightforward once authenticated.