EUVD-2026-46295
GHSA-27f7-w76r-h7r2
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N
High privileges required to plant payload; scope changes because script executes in victim's browser; no integrity or availability impact applies.
Primary rating from Vendor (SolarWinds).
CVSS VectorVendor: SolarWinds
Lifecycle Timeline
1DescriptionCVE.org
SolarWinds Serv-U was found to be affected by a stored cross-site scripting vulnerability that could lead to session hijacking or information disclosure from an administrator account.
AnalysisAI
Stored cross-site scripting in SolarWinds Serv-U enables session hijacking and information disclosure from administrator accounts via malicious script persistence in the application. The vulnerability requires a high-privileged attacker to inject the payload, which then executes in the browser context of any administrator who views the poisoned content - a classic privilege-boundary-crossing XSS pattern confirmed by the CVSS scope-change flag. No public exploit code has been identified at time of analysis, and a vendor fix appears in Serv-U 2026.3 based on release note references.
Technical ContextAI
SolarWinds Serv-U is a managed file transfer and FTP/SFTP server platform widely deployed in enterprises for secure file sharing and transfer workflows. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), the canonical stored XSS root cause, meaning user-supplied input is persisted to a data store and later rendered without adequate output encoding in an administrative web interface. The CPE string cpe:2.3:a:solarwinds:serv-u:*:*:*:*:*:*:*:* covers all versions of the application tier without a fixed upper bound recorded in NVD at time of analysis. The CVSS scope-change (S:C) reflects that the injected script executes in the victim administrator's browser security context rather than the server's own execution context, enabling cross-origin session token theft.
RemediationAI
The primary fix is to upgrade SolarWinds Serv-U to version 2026.3, as indicated by the release notes reference at https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_2026-3_release_notes.htm. Consult the vendor advisory at https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28315 for official guidance and any additional mitigations. Where immediate patching is not possible, restrict administrative web interface access to trusted internal networks or dedicated management VLANs, reducing the attack surface for payload injection. Additionally, enforcing strict role separation so that only a minimal number of accounts hold administrative write access limits which principals can inject a stored payload. Enabling Content Security Policy headers at a reverse proxy layer may partially reduce script execution impact, but should not be treated as a substitute for patching given the application controls the relevant output context.
Remote denial-of-service in SolarWinds Serv-U allows unauthenticated attackers to crash the Serv-U service by sending sp
Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Mem
SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive fil
In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files (that include users' pas
FTP Voyager 16.2.0 contains a denial of service vulnerability that allows local attackers to crash the application by in
A denial of service vulnerability in SolarWinds Serv-U before 15.1.6 HFv1 allows an authenticated user to crash the appl
Share/IncomingWizard.htm in SolarWinds Serv-U before 15.2.3 mishandles the user-supplied SenderEmail parameter, aka "Sha
Privilege escalation in SolarWinds Serv-U allows an authenticated domain administrator account to abuse an insecure dire
Privilege-scoped remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct o
Privilege-to-root remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct
Remote code execution in SolarWinds Serv-U managed file transfer/FTP server allows an attacker to run arbitrary code rem
Privilege escalation to remote code execution as root in SolarWinds Serv-U stems from an insecure direct object referenc
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today