EUVD-2026-46288
GHSA-6wjq-vfxv-86f5
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Network-reachable with valid but low-privileged domain-user credentials (PR:L, contra vendor PR:H), low complexity, and elevation into admin crosses a trust boundary (S:C) yielding full C/I/A impact.
Primary rating from Vendor (SolarWinds).
CVSS VectorVendor: SolarWinds
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain user group to be elevated into an administrator group. The impact is lower in Windows deployments.
AnalysisAI
Privilege escalation in SolarWinds Serv-U allows an authenticated member of a domain user group to be elevated into an administrator group, granting full administrative control over the managed file transfer server. The flaw stems from improper access control (CWE-284) and carries a vendor CVSS of 9.1 due to a scope change and full confidentiality, integrity, and availability impact, though SolarWinds notes the impact is lower on Windows deployments. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to be an authenticated member of a domain user group that is trusted by the Serv-U instance, and the Serv-U deployment must be configured to use domain/directory group-based authorization - the improper elevation is from that domain user group into the administrator group. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H = 9.1) signals a network-reachable, low-complexity attack with a scope change and total impact, but PR:H is inconsistent with a description that only requires membership in a domain user group - an ordinary authenticated user is low-privileged, so real-world privilege requirements may be lower (PR:L) and effective severity higher; verify the exact required privilege level with SolarWinds. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who holds or phishes valid credentials for an ordinary domain user account authenticates to a Serv-U instance that trusts the corresponding domain user group; because the group is improperly mapped, the account is treated as a Serv-U administrator. With administrative control the attacker can read, modify, or exfiltrate all files in transit, alter server configuration, and pivot into connected systems. … |
| Remediation | Upgrade to SolarWinds Serv-U 2026.3, which per the referenced release notes contains the fix; treat this as the primary remediation (Patch available per vendor advisory - exact prior affected versions not enumerated in the input). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all SolarWinds Serv-U instances and identify which domain user groups hold administrative privileges. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote denial-of-service in SolarWinds Serv-U allows unauthenticated attackers to crash the Serv-U service by sending sp
Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Mem
SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive fil
In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files (that include users' pas
A denial of service vulnerability in SolarWinds Serv-U before 15.1.6 HFv1 allows an authenticated user to crash the appl
Share/IncomingWizard.htm in SolarWinds Serv-U before 15.2.3 mishandles the user-supplied SenderEmail parameter, aka "Sha
Privilege escalation in SolarWinds Serv-U allows an authenticated domain administrator account to abuse an insecure dire
Privilege-scoped remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct o
Privilege-to-root remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct
Remote code execution in SolarWinds Serv-U managed file transfer/FTP server allows an attacker to run arbitrary code rem
Privilege escalation to remote code execution as root in SolarWinds Serv-U stems from an insecure direct object referenc
Account takeover in SolarWinds Serv-U managed file transfer server lets an authenticated user access and hijack other us
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today