EUVD-2026-46294
GHSA-w6hc-qj8r-4mjx
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Network-facing service, low-complexity IDOR requiring only a normal authenticated user (PR:L per description's 'user authentication required'); account takeover yields high confidentiality/integrity impact but no inherent availability loss, scope unchanged.
Primary rating from Vendor (SolarWinds).
CVSS VectorVendor: SolarWinds
Lifecycle Timeline
2DescriptionCVE.org
SolarWinds Serv-U is affected by an insecure direct object reference vulnerability that leads to an account takeover. User authentication is required. The impact is lower in Windows deployments.
AnalysisAI
Account takeover in SolarWinds Serv-U managed file transfer server lets an authenticated user access and hijack other users' accounts through an insecure direct object reference (CWE-639), where user-controlled identifiers are not properly authorization-checked. Any valid low-effort authenticated session can be leveraged to reach objects belonging to other accounts, with the vendor noting reduced impact on Windows deployments (implying greater exposure on non-Windows/Linux installs). No public exploit has been identified at time of analysis; the issue was reported by SolarWinds and is fixed in the Serv-U 2026-3 release.
Technical ContextAI
Serv-U is SolarWinds' file transfer server supporting FTP/FTPS/SFTP/HTTP(S) for managed and secure file transfer, deployed on both Windows and Linux. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key), a classic insecure direct object reference: the application uses a client-supplied identifier (such as a user ID, session token, or object reference) to retrieve or act on a resource without verifying that the requesting account is authorized to that specific object. Because the affected component references user accounts by a predictable/controllable key, an attacker can substitute another user's identifier and operate against that account, resulting in takeover. The single CPE in scope is cpe:2.3:a:solarwinds:serv-u:*:*:*:*:*:*:*:*, indicating all Serv-U versions prior to the fixed release are potentially affected regardless of edition.
RemediationAI
Vendor-released patch: Serv-U 2026-3 - upgrade all Serv-U instances to the 2026-3 release per the SolarWinds advisory (https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28314) and release notes (https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_2026-3_release_notes.htm). Because exploitation requires an authenticated session, prioritize patching internet-exposed and Linux deployments first (the vendor notes higher impact off Windows). As compensating controls until patched, restrict Serv-U administrative and web interfaces to trusted networks or a VPN to shrink the pool of accounts that can reach the vulnerable object references, tighten account provisioning and disable or remove unused/anonymous accounts to limit who holds valid credentials, and enforce least-privilege plus monitor logs for cross-account access patterns or unexpected account modifications - with the trade-off that network restrictions may block legitimate remote file-transfer users and stricter monitoring adds operational overhead. These controls reduce but do not eliminate the risk, so upgrading remains the definitive fix.
Remote denial-of-service in SolarWinds Serv-U allows unauthenticated attackers to crash the Serv-U service by sending sp
Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Mem
SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive fil
In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files (that include users' pas
FTP Voyager 16.2.0 contains a denial of service vulnerability that allows local attackers to crash the application by in
A denial of service vulnerability in SolarWinds Serv-U before 15.1.6 HFv1 allows an authenticated user to crash the appl
Share/IncomingWizard.htm in SolarWinds Serv-U before 15.2.3 mishandles the user-supplied SenderEmail parameter, aka "Sha
Privilege escalation in SolarWinds Serv-U allows an authenticated domain administrator account to abuse an insecure dire
Privilege-scoped remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct o
Privilege-to-root remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct
Remote code execution in SolarWinds Serv-U managed file transfer/FTP server allows an attacker to run arbitrary code rem
Privilege escalation to remote code execution as root in SolarWinds Serv-U stems from an insecure direct object referenc
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today