EUVD-2026-46290
GHSA-vv5r-rfhv-vx6x
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Requires pre-existing domain admin (PR:H) over the network with no user interaction; creating a Serv-U system admin crosses an authorization boundary (S:C) yielding full C/I/A over the platform.
Primary rating from Vendor (SolarWinds).
CVSS VectorVendor: SolarWinds
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
SolarWinds Serv-U is affected by a broken access control vulnerability that allows a domain administrator to create system administrator accounts. The impact is lower in Windows deployments.
AnalysisAI
Privilege escalation in SolarWinds Serv-U managed file transfer allows a user holding domain administrator privileges to create Serv-U system administrator accounts, crossing an authorization boundary the product is expected to enforce independently. Tracked as CVE-2026-28309 (CWE-862, Missing Authorization) and reported by SolarWinds, it carries a 9.1 CVSS due to scope change and full C/I/A impact, though the vendor notes the impact is lower in Windows deployments. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to already possess domain administrator privileges (consistent with CVSS PR:H) and network access to the Serv-U management interface; there is no user interaction required (UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H = 9.1) is driven largely by the scope change (S:C) and full impact triad, but the PR:H metric is the decisive real-world limiter: exploitation requires an attacker to already hold domain administrator privileges, which is itself among the most powerful positions in a Windows environment. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An insider or an attacker who has already compromised a domain administrator account logs into Serv-U and uses the account-management functionality to create a new Serv-U system administrator account, granting themselves persistent, application-level control over the file transfer platform and its stored/transiting data. This yields a durable admin foothold that survives remediation of the original domain compromise. … |
| Remediation | Upgrade to the fixed Serv-U 2026-3 release, which is the version referenced in the vendor release notes (https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_2026-3_release_notes.htm); confirm the exact patched build against the SolarWinds security advisory at https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28309. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all SolarWinds Serv-U installations and their deployment platform (Windows vs. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote denial-of-service in SolarWinds Serv-U allows unauthenticated attackers to crash the Serv-U service by sending sp
Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Mem
SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive fil
In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files (that include users' pas
A denial of service vulnerability in SolarWinds Serv-U before 15.1.6 HFv1 allows an authenticated user to crash the appl
Share/IncomingWizard.htm in SolarWinds Serv-U before 15.2.3 mishandles the user-supplied SenderEmail parameter, aka "Sha
Privilege escalation in SolarWinds Serv-U allows an authenticated domain administrator account to abuse an insecure dire
Privilege-scoped remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct o
Privilege-to-root remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct
Remote code execution in SolarWinds Serv-U managed file transfer/FTP server allows an attacker to run arbitrary code rem
Privilege escalation to remote code execution as root in SolarWinds Serv-U stems from an insecure direct object referenc
Account takeover in SolarWinds Serv-U managed file transfer server lets an authenticated user access and hijack other us
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today