EUVD-2026-46295
GHSA-27f7-w76r-h7r2
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N
High privileges required to plant payload; scope changes because script executes in victim's browser; no integrity or availability impact applies.
Primary rating from Vendor (SolarWinds).
CVSS VectorVendor: SolarWinds
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N
Lifecycle Timeline
1DescriptionCVE.org
SolarWinds Serv-U was found to be affected by a stored cross-site scripting vulnerability that could lead to session hijacking or information disclosure from an administrator account.
AnalysisAI
Stored cross-site scripting in SolarWinds Serv-U enables session hijacking and information disclosure from administrator accounts via malicious script persistence in the application. The vulnerability requires a high-privileged attacker to inject the payload, which then executes in the browser context of any administrator who views the poisoned content - a classic privilege-boundary-crossing XSS pattern confirmed by the CVSS scope-change flag. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must already hold a high-privilege administrator account on the SolarWinds Serv-U instance (PR:H per the CVSS vector) sufficient to write data into the field containing the stored XSS payload. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 6.2 reflects a meaningful but bounded risk profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has compromised or legitimately holds a high-privilege Serv-U administrator account injects a JavaScript payload into a field that is stored by the application and rendered in the administrative interface - for example, a filename, user comment, or configuration label. When a peer administrator subsequently navigates to the affected view, their browser executes the script, which reads the administrator's session cookie and exfiltrates it to an attacker-controlled endpoint. … |
| Remediation | The primary fix is to upgrade SolarWinds Serv-U to version 2026.3, as indicated by the release notes reference at https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_2026-3_release_notes.htm. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote denial-of-service in SolarWinds Serv-U allows unauthenticated attackers to crash the Serv-U service by sending sp
Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Mem
SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive fil
In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files (that include users' pas
A denial of service vulnerability in SolarWinds Serv-U before 15.1.6 HFv1 allows an authenticated user to crash the appl
Share/IncomingWizard.htm in SolarWinds Serv-U before 15.2.3 mishandles the user-supplied SenderEmail parameter, aka "Sha
Privilege escalation in SolarWinds Serv-U allows an authenticated domain administrator account to abuse an insecure dire
Privilege-scoped remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct o
Privilege-to-root remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct
Remote code execution in SolarWinds Serv-U managed file transfer/FTP server allows an attacker to run arbitrary code rem
Privilege escalation to remote code execution as root in SolarWinds Serv-U stems from an insecure direct object referenc
Account takeover in SolarWinds Serv-U managed file transfer server lets an authenticated user access and hijack other us
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today