EUVD-2026-46299
GHSA-qmpv-cmj3-27m6
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Domain administrator access is required so PR:H; network-reachable service with low complexity, and file write to root code execution crosses a privilege boundary giving S:C with full CIA impact.
Primary rating from Vendor (SolarWinds).
CVSS VectorVendor: SolarWinds
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
SolarWinds Serv-U is affected by a broken access control vulnerability that could allow arbitrary file read and write, which can then be used to escalate privileges and execute code as root. A domain administrator access is required, and the impact is lower in Windows installations.
AnalysisAI
Privilege escalation to root/code execution in SolarWinds Serv-U (managed/secure file transfer server) arises from a broken access control flaw that grants arbitrary file read and write on the host. An attacker already holding domain administrator access can abuse this to overwrite privileged files and run code as root, with reduced impact on Windows installations. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to already hold domain administrator access, per the CVE description and consistent with the CVSS PR:H metric - this is the primary limiting factor and means the flaw is not exploitable by unauthenticated or low-privileged users. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, base 9.1) is dominated by the scope change and full CIA impact, but the PR:H metric is decisive: exploitation requires domain administrator privileges, which is an extremely high bar and materially reduces real-world risk versus an unauthenticated network flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An adversary who has already compromised a domain administrator account (for example via prior credential theft) authenticates to a Serv-U host and abuses the broken access control to write a crafted file to a privileged location. On a Linux deployment this yields code execution as root, converting an existing domain-admin foothold into full host takeover and a durable pivot point. … |
| Remediation | Patch available per vendor advisory: upgrade to SolarWinds Serv-U 2026-3, referenced in the release notes at https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_2026-3_release_notes.htm, and review the advisory at https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28321 for the exact fixed build. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all SolarWinds Serv-U instances in production, document installed versions, and audit domain administrator account access to Serv-U systems and hosts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote denial-of-service in SolarWinds Serv-U allows unauthenticated attackers to crash the Serv-U service by sending sp
Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Mem
SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive fil
In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files (that include users' pas
A denial of service vulnerability in SolarWinds Serv-U before 15.1.6 HFv1 allows an authenticated user to crash the appl
Share/IncomingWizard.htm in SolarWinds Serv-U before 15.2.3 mishandles the user-supplied SenderEmail parameter, aka "Sha
Privilege escalation in SolarWinds Serv-U allows an authenticated domain administrator account to abuse an insecure dire
Privilege-scoped remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct o
Privilege-to-root remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct
Remote code execution in SolarWinds Serv-U managed file transfer/FTP server allows an attacker to run arbitrary code rem
Privilege escalation to remote code execution as root in SolarWinds Serv-U stems from an insecure direct object referenc
Account takeover in SolarWinds Serv-U managed file transfer server lets an authenticated user access and hijack other us
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today