EUVD-2026-46291
GHSA-9wqx-3624-p2v9
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Requires existing domain-admin privileges (PR:H) over the network with low complexity; escalation to system admin crosses an authorization boundary (S:C) yielding full control over the service and its data (C:H/I:H/A:H).
Primary rating from Vendor (SolarWinds).
CVSS VectorVendor: SolarWinds
Lifecycle Timeline
2DescriptionCVE.org
SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to escalate their user type to that of a system administrator. The impact is lower in Windows deployments.
AnalysisAI
Privilege escalation in SolarWinds Serv-U managed file transfer server allows an existing domain administrator to elevate their Serv-U account from a standard user type to a full system administrator, granting complete control over the file transfer service and its data. The flaw stems from missing authorization (CWE-862) and carries a CVSS 9.1 rating, driven by a scope change and high confidentiality, integrity, and availability impact. SolarWinds notes the impact is lower in Windows deployments, and there is no public exploit identified at time of analysis.
Technical ContextAI
SolarWinds Serv-U is a commercial managed file transfer (MFT) and secure FTP/FTPS/SFTP/HTTPS server used to move sensitive files across enterprises. The affected component is Serv-U's authorization model, which distinguishes user types (regular users, domain administrators, and system administrators) with escalating control over server configuration, domains, and user provisioning. The root cause is CWE-862 (Missing Authorization): the application fails to properly enforce the boundary between a domain administrator and a system administrator, so an account already trusted at the domain-admin tier can cross into full system-admin control. The single affected CPE, cpe:2.3:a:solarwinds:serv-u:*:*:*:*:*:*:*:*, is version-agnostic in the intelligence provided, but the referenced Serv-U 2026-3 release notes indicate the fix landed in that release train.
RemediationAI
Upgrade to the fixed Serv-U release identified in the vendor's 2026-3 release notes (https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_2026-3_release_notes.htm); patch available per vendor advisory, though an exact patched build number is not independently confirmed in the provided data - consult the SolarWinds advisory at https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28310 for the precise version. Until patched, tightly restrict and audit accounts granted the Serv-U domain-administrator role, since exploitation requires that privilege level; remove unnecessary domain-admin assignments and enable logging/alerting on user-type or system-administrator changes to detect escalation attempts. Prioritize non-Windows (Linux) deployments, where SolarWinds indicates impact is higher. As a compensating control, place the Serv-U management interface behind network segmentation or restrict administrative access to trusted management hosts to reduce the exposure of privileged accounts, accepting the trade-off of reduced administrative convenience.
Remote denial-of-service in SolarWinds Serv-U allows unauthenticated attackers to crash the Serv-U service by sending sp
Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Mem
SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive fil
In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files (that include users' pas
FTP Voyager 16.2.0 contains a denial of service vulnerability that allows local attackers to crash the application by in
A denial of service vulnerability in SolarWinds Serv-U before 15.1.6 HFv1 allows an authenticated user to crash the appl
Share/IncomingWizard.htm in SolarWinds Serv-U before 15.2.3 mishandles the user-supplied SenderEmail parameter, aka "Sha
Privilege escalation in SolarWinds Serv-U allows an authenticated domain administrator account to abuse an insecure dire
Privilege-scoped remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct o
Privilege-to-root remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct
Remote code execution in SolarWinds Serv-U managed file transfer/FTP server allows an attacker to run arbitrary code rem
Privilege escalation to remote code execution as root in SolarWinds Serv-U stems from an insecure direct object referenc
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today