SolarWinds Serv-U EUVD-2026-46293

Exploitation requires an authenticated, privileged Serv-U session per the CVSS PR:H metric, plus network reachability to the Serv-U interface (AV:N), and hinges on the SMTP/email account workflow being in use - the IDOR abuses the email-notification/account object to redirect messages and take over another account. Limiting factors: the attacker must already possess valid privileged credentials (not unauthenticated), no victim user interaction is required (UI:N), and the impact is explicitly reduced on Windows deployments, so non-Windows (e.g., Linux) installations face the fuller consequence. Environments that do not use Serv-U email notifications may present a smaller attack surface - confirm with the vendor whether the email feature must be configured for the IDOR to be reachable.

The vendor CVSS of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) reflects a network-reachable, low-complexity flaw with a scope change and full CIA impact, but it critically requires high privileges (PR:H) - meaning the attacker must already hold a privileged Serv-U account, which sharply narrows the realistic attacker population versus an unauthenticated bug. There is a tension worth flagging: an IDOR account-takeover typically needs only a valid low-privilege session, so PR:H may overstate the required privilege - verify the true privilege prerequisite with SolarWinds. No EPSS score, KEV entry, or POC is present in the provided data, so there is no evidence of active exploitation or automation; this reads as a serious-but-authentication-gated issue rather than a mass-exploitable internet bug. Serv-U's history of being targeted (prior CVEs reaching CISA KEV) nonetheless warrants prompt patching despite the current absence of exploitation signals.

An attacker holding a privileged Serv-U account (or one they have compromised) sends a crafted request manipulating an account/email object identifier to redirect SMTP-driven messages - such as password-reset or notification email - for a targeted victim account. By capturing that email flow, the attacker completes a password reset or otherwise seizes control of the victim's account and its file access. No public POC is identified in the available data, and the low attack complexity (AC:L) means the request itself is straightforward once a suitable account is held.