EUVD-2026-46289
GHSA-hjp7-x3qv-vqf3
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Network-reachable admin interface (AV:N/AC:L) but requires domain administrator privileges (PR:H); IDOR-to-RCE escaping the domain boundary justifies S:C with full C/I/A impact.
Primary rating from Vendor (SolarWinds).
CVSS VectorVendor: SolarWinds
Lifecycle Timeline
2DescriptionCVE.org
SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution. Domain administrator access is required. The impact is lower in Windows deployments.
AnalysisAI
Privilege-scoped remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct object reference that lets an authenticated domain administrator reference objects outside their intended authorization boundary to run code on the host. The flaw carries a 9.1 CVSS due to network reach, scope change, and full confidentiality/integrity/availability impact, though the practical bar is high because domain administrator access is a prerequisite, and impact is reduced on Windows deployments. No public exploit is identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
Serv-U is SolarWinds' commercial managed file transfer (MFT) and secure FTP/HTTP/SFTP server, identified by cpe:2.3:a:solarwinds:serv-u:*:*:*:*:*:*:*:*, deployed on both Windows and Linux to move files across FTP, FTPS, SFTP and HTTP(S). The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key / IDOR): the application uses a client-supplied identifier to select an internal object without verifying that the requesting principal is authorized for that specific object. Because Serv-U supports domain-scoped administration, a domain administrator - intended to be confined to a single domain's resources - can manipulate an object reference to reach resources or code paths beyond that domain, and the tagging as an authentication/authorization bypass reflects the missing per-object access check rather than a memory-safety bug.
RemediationAI
Upgrade Serv-U to the fixed build shipped in the SolarWinds Serv-U 2026-3 release as described in the release notes (https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_2026-3_release_notes.htm) and cross-referenced in the advisory (https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28308); the exact patched version string is not stated in the provided input, so validate the target build against those pages before rollout. Because exploitation requires domain administrator privileges, the strongest compensating control is to minimize and tightly govern domain-admin accounts in Serv-U - reduce the number of domain administrators, enforce MFA on those accounts, and audit their creation and activity - accepting the trade-off of added administrative friction. Additionally restrict management-plane network access to the Serv-U admin console (bind it to a management VLAN or place it behind a VPN/allowlist) to limit who can reach the privileged interface, monitoring logs for anomalous cross-domain object access; on Windows the vendor-noted lower impact may modestly reduce urgency but does not remove the need to patch.
Remote denial-of-service in SolarWinds Serv-U allows unauthenticated attackers to crash the Serv-U service by sending sp
Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Mem
SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive fil
In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files (that include users' pas
FTP Voyager 16.2.0 contains a denial of service vulnerability that allows local attackers to crash the application by in
A denial of service vulnerability in SolarWinds Serv-U before 15.1.6 HFv1 allows an authenticated user to crash the appl
Share/IncomingWizard.htm in SolarWinds Serv-U before 15.2.3 mishandles the user-supplied SenderEmail parameter, aka "Sha
Privilege escalation in SolarWinds Serv-U allows an authenticated domain administrator account to abuse an insecure dire
Privilege-to-root remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct
Remote code execution in SolarWinds Serv-U managed file transfer/FTP server allows an attacker to run arbitrary code rem
Privilege escalation to remote code execution as root in SolarWinds Serv-U stems from an insecure direct object referenc
Account takeover in SolarWinds Serv-U managed file transfer server lets an authenticated user access and hijack other us
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today