EUVD-2026-46286
GHSA-wv2m-rg59-7rh5
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
PR:H because a domain admin account with home-directory write access is required; S:C and C/I/A:H reflect escape from app-admin to root-level OS code execution on Linux.
Primary rating from Vendor (SolarWinds).
CVSS VectorVendor: SolarWinds
Lifecycle Timeline
2DescriptionCVE.org
SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution as root. A domain account with admin privileges and read and write access to the home directory is required. The impact is lower in Windows deployments.
AnalysisAI
Privilege-to-root remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct object reference (CWE-639) that an authenticated domain administrator with read/write access to the home directory can abuse to execute code as root on the underlying host. The CVSS 3.1 score of 9.1 reflects a scope change from application-admin context to full OS compromise, with the impact explicitly noted as lower on Windows deployments. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, so this is a high-severity but authentication-gated flaw rather than a mass-exploitable unauthenticated bug.
Technical ContextAI
SolarWinds Serv-U is an enterprise managed file transfer (MFT/FTP/SFTP/HTTPS) server deployed on Windows and Linux, identified by CPE cpe:2.3:a:solarwinds:serv-u:*. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key / Insecure Direct Object Reference): the application uses a client-supplied identifier to reference an object - here a filesystem home-directory path - without adequately validating that the requesting principal is authorized for the resulting operation. Because Serv-U on Linux runs privileged operations as root, manipulating this object reference in combination with read/write control over the home directory lets an admin-level account escape the application's intended boundary and reach OS-level code execution; on Windows the privilege model limits the resulting impact, consistent with the vendor's note.
RemediationAI
Patch available per vendor advisory: upgrade to SolarWinds Serv-U 2026-3, which the referenced release notes (https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_2026-3_release_notes.htm) indicate addresses this issue; consult the CVE-2026-28305 security advisory (https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28305) for the exact patched build applicable to your platform. Because exploitation requires an authenticated domain admin account with read/write access to the home directory, effective compensating controls until patching are to tightly restrict who holds Serv-U administrative and domain-admin privileges, remove unnecessary write access to home directories used by the service, and audit admin account usage - with the trade-off that these controls constrain legitimate administrative workflows. On Linux, where the root-level impact is greatest, prioritize patching and consider running the service under a least-privilege account where supported; Windows deployments are lower risk per the vendor but should still be updated.
Remote denial-of-service in SolarWinds Serv-U allows unauthenticated attackers to crash the Serv-U service by sending sp
Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Mem
SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive fil
In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files (that include users' pas
FTP Voyager 16.2.0 contains a denial of service vulnerability that allows local attackers to crash the application by in
A denial of service vulnerability in SolarWinds Serv-U before 15.1.6 HFv1 allows an authenticated user to crash the appl
Share/IncomingWizard.htm in SolarWinds Serv-U before 15.2.3 mishandles the user-supplied SenderEmail parameter, aka "Sha
Privilege escalation in SolarWinds Serv-U allows an authenticated domain administrator account to abuse an insecure dire
Privilege-scoped remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct o
Remote code execution in SolarWinds Serv-U managed file transfer/FTP server allows an attacker to run arbitrary code rem
Privilege escalation to remote code execution as root in SolarWinds Serv-U stems from an insecure direct object referenc
Account takeover in SolarWinds Serv-U managed file transfer server lets an authenticated user access and hijack other us
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today