EUVD-2026-46296
GHSA-mh8r-8vh8-m2q8
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Requires a pre-existing domain admin account so PR:H; network-reachable and low-complexity IDOR that escalates across a privilege boundary to root, justifying S:C and full C/I/A:H.
Primary rating from Vendor (SolarWinds).
CVSS VectorVendor: SolarWinds
Lifecycle Timeline
2DescriptionCVE.org
SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation to a system administrator with the ability to execute commands as the root user. This issue requires a domain account with administrator access. The impact is lower in Windows deployments.
AnalysisAI
Privilege escalation in SolarWinds Serv-U allows an authenticated domain administrator account to abuse an insecure direct object reference (IDOR) and elevate to a system administrator, ultimately executing commands as the root user on the underlying host. The flaw affects Serv-U file transfer server deployments, with a reduced impact on Windows installations, and carries a CVSS 9.1 rating driven by a scope change from application admin to OS-level root. There is no public exploit identified at time of analysis and no CISA KEV listing, but SolarWinds self-reported and shipped a fix in the Serv-U 2026-3 release.
Technical ContextAI
Serv-U is SolarWinds' managed file transfer (MFT) and FTP/FTPS/SFTP/HTTP(S) server product (cpe:2.3:a:solarwinds:serv-u:*). The root cause is CWE-639, Authorization Bypass Through User-Controlled Key - an IDOR in which the application trusts a client-supplied identifier to select or act on an object (here, an administrative/system-level object) without verifying that the requesting account is actually authorized for that object. Because a domain-level administrator can reference privileged objects belonging to a higher trust tier, the authorization boundary between a domain administrator and a full system administrator collapses, and on non-Windows deployments this reaches command execution as root. The 'impact is lower in Windows deployments' note implies the root-user command execution path is tied to the service's privilege model on Linux/Unix hosts, where the Serv-U process operates with root-equivalent rights.
RemediationAI
Upgrade to SolarWinds Serv-U 2026-3, which contains the fix per the vendor release notes (https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_2026-3_release_notes.htm); review the security advisory at https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28316 to confirm the exact patched build for your platform. Patch available per vendor advisory (Serv-U 2026-3). Because exploitation requires an existing domain administrator account, the strongest compensating control until patching is to tightly restrict and audit which accounts hold Serv-U domain-administrator rights and to remove unneeded admin grants, accepting the trade-off of reduced delegated administration. On Linux/Unix hosts where the command-execution-as-root impact applies, run the Serv-U service under a least-privileged non-root account if your deployment supports it (trade-off: some functions expecting root may break, so test first), and restrict network access to the administrative/management interface to trusted management subnets via firewall rules to limit who can reach the vulnerable object references. Prioritize Linux/Unix instances over Windows, where impact is lower.
Remote denial-of-service in SolarWinds Serv-U allows unauthenticated attackers to crash the Serv-U service by sending sp
Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Mem
SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive fil
In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files (that include users' pas
FTP Voyager 16.2.0 contains a denial of service vulnerability that allows local attackers to crash the application by in
A denial of service vulnerability in SolarWinds Serv-U before 15.1.6 HFv1 allows an authenticated user to crash the appl
Share/IncomingWizard.htm in SolarWinds Serv-U before 15.2.3 mishandles the user-supplied SenderEmail parameter, aka "Sha
Privilege-scoped remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct o
Privilege-to-root remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct
Remote code execution in SolarWinds Serv-U managed file transfer/FTP server allows an attacker to run arbitrary code rem
Privilege escalation to remote code execution as root in SolarWinds Serv-U stems from an insecure direct object referenc
Account takeover in SolarWinds Serv-U managed file transfer server lets an authenticated user access and hijack other us
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today