EUVD-2026-46285
GHSA-2737-hj93-8fjw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach network-exposed Serv-U service
-
DeliverySend crafted request bypassing access control
-
ExploitTrigger unauthorized code execution
-
ExecutionRun arbitrary code as root
-
ImpactFull host compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the Serv-U service (AV:N, AC:L, no user interaction). The provided CVSS vector states PR:H (high privileges required), but the vendor 'Authentication Bypass' tag and CWE-284 directly conflict with that, implying the authentication/authorization requirement can be subverted - this contradiction should be confirmed with SolarWinds before relying on PR:H as a mitigating factor. The key vendor-confirmed limiting factor is platform: Unix/Linux deployments running the daemon as root suffer full root-level RCE, whereas Windows deployments are explicitly lower impact. Affected versions are those prior to Serv-U 2026-3. |
| Impact | The signals are mixed and partly contradictory, which teams should weigh carefully. The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H = 9.1) indicates network-reachable, low-complexity, no user interaction, but requires HIGH privileges (PR:H) - yet the 'Authentication Bypass' tag and CWE-284 imply attackers can subvert authentication, which conflicts with PR:H and would push real-world risk higher. This discrepancy should be verified with SolarWinds: if it is genuinely an authentication bypass, the effective privilege requirement is closer to PR:N/PR:L and practical severity approaches unauthenticated critical RCE. No EPSS score, no KEV listing, and no POC were provided, so there is no current evidence of active or automated exploitation. Given Serv-U's history as an internet-exposed MFT target for mass-scanning campaigns, treat this as a high-priority patch despite the absence of exploitation data, because the bug class and exposure profile are exactly what opportunistic attackers favor. |
| Exploit ScenarioDerived | An attacker who can reach the Serv-U service over the network abuses the improper access-control / authentication-bypass flaw to submit a crafted request that is processed with insufficient authorization checks, causing arbitrary code to execute in the Serv-U process context - as root on a Linux host. On Unix/Linux this results in full host compromise; on Windows the attacker gains code execution at lower privilege. No public POC was provided at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 21, 2026
Remote code execution in SolarWinds Serv-U managed file transfer/FTP server allows an attacker to run arbitrary code remotely, executing as root on Unix/Linux deployments while impact is reduced on Windows. The flaw stems from an access-control weakness (CWE-284) and is corroborated by a vendor 'Authentication Bypass' tag, carrying a CVSS 9.1 (scope-changed) rating. No public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is currently theoretical rather than confirmed.
RemediationAI
Upgrade to SolarWinds Serv-U 2026-3, which contains the fix per the release notes (https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_2026-3_release_notes.htm); review the vendor advisory at https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28304 for the exact fixed build before deploying. Until patched, reduce exposure by restricting network access to the Serv-U management and file-transfer listeners to trusted management networks or VPN only (trade-off: remote and partner users lose direct access), placing the server behind a firewall ACL or reverse proxy that limits reachable endpoints, and - on Unix/Linux where impact is greatest - running the daemon under a dedicated non-root least-privilege service account where the deployment supports it (trade-off: may require reconfiguring privileges to bind low ports). Prioritize internet-facing instances first and monitor authentication and admin-endpoint logs for anomalous access.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SolarWinds Serv-U is a widely used managed file transfer (MFT) and secure FTP/FTPS/SFTP/HTTP(S) server for exchanging files across enterprises, and it is a historically high-value target because it is internet-facing by design. The CWE-284 (Improper Access Control) classification together with the vendor's 'Authentication Bypass' tag indicates the root cause is a failure to correctly enforce authorization/authentication boundaries rather than a memory-corruption bug, which then permits code execution. On Unix/Linux the Serv-U daemon commonly runs as root, so successful exploitation yields root-level code execution; on Windows the service runs in a different context, which the vendor states lowers the impact. The single affected product per CPE is cpe:2.3:a:solarwinds:serv-u, covering versions prior to the fixed 2026-3 release.
Know when Serv U gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Network-reachable, low-complexity RCE with scope change (root beyond app); PR:L chosen because the auth-bypass tag and CWE-284 undercut the input's PR:H, though this remains unresolved.
Primary rating from Vendor (SolarWinds).
CVSS VectorVendor: SolarWinds
DescriptionCVE.org
SolarWinds Serv-U is affected by a remote code execution vulnerability that, when exploited, can allow the arbitrary execution of code remotely as root. The impact is lower in Windows deployments.
Executive ViewAI
SolarWinds Serv-U managed file transfer servers are vulnerable to unauthenticated remote code execution affecting Windows, Unix, and Linux deployments. Attackers can execute arbitrary commands with elevated privileges (root on Unix/Linux), potentially compromising data confidentiality, integrity, and business continuity for any organization operating this software in production environments. No vendor patch is currently available, creating immediate risk requiring urgent containment actions.
Disable external-facing access to Serv-U systems immediately; restrict to internal networks only via VPN or jump host authentication. Implement network segmentation and firewall policies to isolate Serv-U from internet-exposed systems and untrusted networks. Enable comprehensive audit logging and behavioral monitoring to detect unauthorized access attempts and anomalous command execution. Deploy intrusion detection signatures to identify exploitation attempts. Consider operational workarounds using alternative file transfer methods for non-critical operations to reduce the exposure window until vendor patches become available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Remote denial-of-service in SolarWinds Serv-U allows unauthenticated attackers to crash the Serv-U service by sending sp
Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Mem
SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive fil
In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files (that include users' pas
FTP Voyager 16.2.0 contains a denial of service vulnerability that allows local attackers to crash the application by in
A denial of service vulnerability in SolarWinds Serv-U before 15.1.6 HFv1 allows an authenticated user to crash the appl
Share/IncomingWizard.htm in SolarWinds Serv-U before 15.2.3 mishandles the user-supplied SenderEmail parameter, aka "Sha
Privilege escalation in SolarWinds Serv-U allows an authenticated domain administrator account to abuse an insecure dire
Privilege-scoped remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct o
Privilege-to-root remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct
Privilege escalation to remote code execution as root in SolarWinds Serv-U stems from an insecure direct object referenc
Account takeover in SolarWinds Serv-U managed file transfer server lets an authenticated user access and hijack other us
Exploit-DB