EUVD-2026-46286
GHSA-wv2m-rg59-7rh5
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
PR:H because a domain admin account with home-directory write access is required; S:C and C/I/A:H reflect escape from app-admin to root-level OS code execution on Linux.
Primary rating from Vendor (SolarWinds).
CVSS VectorVendor: SolarWinds
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution as root. A domain account with admin privileges and read and write access to the home directory is required. The impact is lower in Windows deployments.
AnalysisAI
Privilege-to-root remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct object reference (CWE-639) that an authenticated domain administrator with read/write access to the home directory can abuse to execute code as root on the underlying host. The CVSS 3.1 score of 9.1 reflects a scope change from application-admin context to full OS compromise, with the impact explicitly noted as lower on Windows deployments. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a domain account that already holds Serv-U administrative privileges plus read and write access to the home directory - these are the exact prerequisites stated in the description, meaning this is not exploitable against a default unprivileged or anonymous session. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) drives the 9.1 score, but the single most important signal is PR:H - exploitation requires an already-privileged domain account with admin rights and read/write access to the home directory, so this is not an unauthenticated internet-facing takeover. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained (or an insider who holds) a domain account with Serv-U admin privileges and read/write access to the home directory manipulates an object reference exposed by the application to point at a filesystem path outside their intended authorization boundary. On a Linux host this is leveraged to write and trigger execution of attacker-controlled content as root, converting application-level administration into full operating-system compromise. … |
| Remediation | Patch available per vendor advisory: upgrade to SolarWinds Serv-U 2026-3, which the referenced release notes (https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_2026-3_release_notes.htm) indicate addresses this issue; consult the CVE-2026-28305 security advisory (https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28305) for the exact patched build applicable to your platform. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct an inventory of all SolarWinds Serv-U instances and identify all accounts with domain administrator privileges and read/write access to home directories. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote denial-of-service in SolarWinds Serv-U allows unauthenticated attackers to crash the Serv-U service by sending sp
Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Mem
SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive fil
In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files (that include users' pas
A denial of service vulnerability in SolarWinds Serv-U before 15.1.6 HFv1 allows an authenticated user to crash the appl
Share/IncomingWizard.htm in SolarWinds Serv-U before 15.2.3 mishandles the user-supplied SenderEmail parameter, aka "Sha
Privilege escalation in SolarWinds Serv-U allows an authenticated domain administrator account to abuse an insecure dire
Privilege-scoped remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct o
Remote code execution in SolarWinds Serv-U managed file transfer/FTP server allows an attacker to run arbitrary code rem
Privilege escalation to remote code execution as root in SolarWinds Serv-U stems from an insecure direct object referenc
Account takeover in SolarWinds Serv-U managed file transfer server lets an authenticated user access and hijack other us
Privilege escalation to root/code execution in SolarWinds Serv-U (managed/secure file transfer server) arises from a bro
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today