EUVD-2026-46285
GHSA-2737-hj93-8fjw
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Network-reachable, low-complexity RCE with scope change (root beyond app); PR:L chosen because the auth-bypass tag and CWE-284 undercut the input's PR:H, though this remains unresolved.
Primary rating from Vendor (SolarWinds).
CVSS VectorVendor: SolarWinds
Lifecycle Timeline
2DescriptionCVE.org
SolarWinds Serv-U is affected by a remote code execution vulnerability that, when exploited, can allow the arbitrary execution of code remotely as root. The impact is lower in Windows deployments.
AnalysisAI
Remote code execution in SolarWinds Serv-U managed file transfer/FTP server allows an attacker to run arbitrary code remotely, executing as root on Unix/Linux deployments while impact is reduced on Windows. The flaw stems from an access-control weakness (CWE-284) and is corroborated by a vendor 'Authentication Bypass' tag, carrying a CVSS 9.1 (scope-changed) rating. No public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is currently theoretical rather than confirmed.
Technical ContextAI
SolarWinds Serv-U is a widely used managed file transfer (MFT) and secure FTP/FTPS/SFTP/HTTP(S) server for exchanging files across enterprises, and it is a historically high-value target because it is internet-facing by design. The CWE-284 (Improper Access Control) classification together with the vendor's 'Authentication Bypass' tag indicates the root cause is a failure to correctly enforce authorization/authentication boundaries rather than a memory-corruption bug, which then permits code execution. On Unix/Linux the Serv-U daemon commonly runs as root, so successful exploitation yields root-level code execution; on Windows the service runs in a different context, which the vendor states lowers the impact. The single affected product per CPE is cpe:2.3:a:solarwinds:serv-u, covering versions prior to the fixed 2026-3 release.
RemediationAI
Upgrade to SolarWinds Serv-U 2026-3, which contains the fix per the release notes (https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_2026-3_release_notes.htm); review the vendor advisory at https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28304 for the exact fixed build before deploying. Until patched, reduce exposure by restricting network access to the Serv-U management and file-transfer listeners to trusted management networks or VPN only (trade-off: remote and partner users lose direct access), placing the server behind a firewall ACL or reverse proxy that limits reachable endpoints, and - on Unix/Linux where impact is greatest - running the daemon under a dedicated non-root least-privilege service account where the deployment supports it (trade-off: may require reconfiguring privileges to bind low ports). Prioritize internet-facing instances first and monitor authentication and admin-endpoint logs for anomalous access.
Remote denial-of-service in SolarWinds Serv-U allows unauthenticated attackers to crash the Serv-U service by sending sp
Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Mem
SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive fil
In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files (that include users' pas
FTP Voyager 16.2.0 contains a denial of service vulnerability that allows local attackers to crash the application by in
A denial of service vulnerability in SolarWinds Serv-U before 15.1.6 HFv1 allows an authenticated user to crash the appl
Share/IncomingWizard.htm in SolarWinds Serv-U before 15.2.3 mishandles the user-supplied SenderEmail parameter, aka "Sha
Privilege escalation in SolarWinds Serv-U allows an authenticated domain administrator account to abuse an insecure dire
Privilege-scoped remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct o
Privilege-to-root remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct
Privilege escalation to remote code execution as root in SolarWinds Serv-U stems from an insecure direct object referenc
Account takeover in SolarWinds Serv-U managed file transfer server lets an authenticated user access and hijack other us
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today