EUVD-2026-46299
GHSA-qmpv-cmj3-27m6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain domain administrator access
-
DeliveryAuthenticate to Serv-U host
-
ExploitAbuse broken access control for arbitrary file write
-
ExecutionOverwrite privileged file
-
ImpactExecute code as root
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already hold domain administrator access, per the CVE description and consistent with the CVSS PR:H metric - this is the primary limiting factor and means the flaw is not exploitable by unauthenticated or low-privileged users. The affected component is the SolarWinds Serv-U file transfer server, and the arbitrary file read/write must be reachable to leverage the improper access control. Impact is platform-dependent: full escalation to root code execution applies to Linux installations, while Windows installations are explicitly noted to have lower impact, limiting the outcome there. No special non-default feature toggle is named in the source data beyond the domain-admin prerequisite. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, base 9.1) is dominated by the scope change and full CIA impact, but the PR:H metric is decisive: exploitation requires domain administrator privileges, which is an extremely high bar and materially reduces real-world risk versus an unauthenticated network flaw. No EPSS score, KEV listing, or SSVC decision data was provided, and no public exploit was identified at time of analysis, so there is no evidence of active or automatable exploitation. The description's 'domain administrator access is required' aligns with PR:H, so the signals are internally consistent. Net assessment: a genuinely severe post-compromise escalation primitive, but not a mass-exploitation emergency - it matters most as a lateral-movement/root-attainment step for an attacker who has already achieved domain admin, and the reduced Windows impact should be factored into prioritization. |
| Exploit ScenarioDerived | An adversary who has already compromised a domain administrator account (for example via prior credential theft) authenticates to a Serv-U host and abuses the broken access control to write a crafted file to a privileged location. On a Linux deployment this yields code execution as root, converting an existing domain-admin foothold into full host takeover and a durable pivot point. No public exploit was identified at time of analysis, so this would require custom tooling. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 21, 2026
Privilege escalation to root/code execution in SolarWinds Serv-U (managed/secure file transfer server) arises from a broken access control flaw that grants arbitrary file read and write on the host. An attacker already holding domain administrator access can abuse this to overwrite privileged files and run code as root, with reduced impact on Windows installations. Reported by SolarWinds with no public exploit identified at time of analysis, though the 9.1 CVSS reflects the high confidentiality, integrity, and availability impact once the precondition is met.
RemediationAI
Patch available per vendor advisory: upgrade to SolarWinds Serv-U 2026-3, referenced in the release notes at https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_2026-3_release_notes.htm, and review the advisory at https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28321 for the exact fixed build. Because exploitation requires domain administrator access, the strongest compensating control is tightening privileged access: enforce least privilege and tiered administration so Serv-U hosts are not reachable by broad domain admin accounts, monitor and alert on unexpected file writes by the Serv-U service to system paths, and run the Serv-U service under a constrained, non-root service account where the platform allows - noting this may require re-testing file transfer functionality and permissions. On Linux, where impact is highest, prioritize the upgrade; on Windows the reduced impact still warrants patching but may be scheduled with lower urgency.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Serv-U is SolarWinds' file transfer server supporting FTP, FTPS, SFTP/SCP, and HTTP(S) for enterprise MFT use, deployed on both Linux and Windows hosts. The root cause is classified under CWE-284 (Improper Access Control): an operation that should be restricted is reachable by a privileged-but-unauthorized principal, allowing the service to read and write files outside its intended boundary. Because the Serv-U service process interacts with the host filesystem, arbitrary write can be leveraged to modify files executed with elevated privileges, culminating in root-level code execution on Linux; on Windows the privilege model constrains the outcome, so the vendor notes lower impact there. The affected product is identified by CPE cpe:2.3:a:solarwinds:serv-u:*:*:*:*:*:*:*:*.
Know when Serv U gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Domain administrator access is required so PR:H; network-reachable service with low complexity, and file write to root code execution crosses a privilege boundary giving S:C with full CIA impact.
Primary rating from Vendor (SolarWinds).
CVSS VectorVendor: SolarWinds
DescriptionCVE.org
SolarWinds Serv-U is affected by a broken access control vulnerability that could allow arbitrary file read and write, which can then be used to escalate privileges and execute code as root. A domain administrator access is required, and the impact is lower in Windows installations.
Executive ViewAI
SolarWinds Serv-U contains a privilege escalation vulnerability (CVE-2026-28321, CVSS 9.1) allowing domain-authenticated attackers to achieve root-level code execution and arbitrary file manipulation on file transfer hosts. Organizations relying on Serv-U for secure data transfer face significant risk of data exfiltration and persistent system compromise if domain administrator credentials are compromised. The absence of a vendor patch requires immediate compensating controls to protect sensitive file transfer infrastructure.
No vendor-released patch identified at time of analysis. Interim mitigations include: enforcing least-privilege access controls limiting domain administrator access to Serv-U systems; implementing real-time alerting on suspicious administrative file operations and process execution; deploying file integrity monitoring to detect unauthorized system file changes; segmenting Serv-U infrastructure on isolated network segments to prevent lateral movement and data exfiltration; conducting forensic-ready backups to enable incident investigation; and maintaining continuous monitoring of SolarWinds security advisories for patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote denial-of-service in SolarWinds Serv-U allows unauthenticated attackers to crash the Serv-U service by sending sp
Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Mem
SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive fil
In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files (that include users' pas
FTP Voyager 16.2.0 contains a denial of service vulnerability that allows local attackers to crash the application by in
A denial of service vulnerability in SolarWinds Serv-U before 15.1.6 HFv1 allows an authenticated user to crash the appl
Share/IncomingWizard.htm in SolarWinds Serv-U before 15.2.3 mishandles the user-supplied SenderEmail parameter, aka "Sha
Privilege escalation in SolarWinds Serv-U allows an authenticated domain administrator account to abuse an insecure dire
Privilege-scoped remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct o
Privilege-to-root remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct
Remote code execution in SolarWinds Serv-U managed file transfer/FTP server allows an attacker to run arbitrary code rem
Privilege escalation to remote code execution as root in SolarWinds Serv-U stems from an insecure direct object referenc
Exploit-DB