Serv U

Privilege escalation to root/code execution in SolarWinds Serv-U (managed/secure file transfer server) arises from a broken access control flaw that grants arbitrary file read and write on the host. An attacker already holding domain administrator access can abuse this to overwrite privileged files and run code as root, with reduced impact on Windows installations. Reported by SolarWinds with no public exploit identified at time of analysis, though the 9.1 CVSS reflects the high confidentiality, integrity, and availability impact once the precondition is met.

Privilege escalation in SolarWinds Serv-U file transfer server arises from an insecure direct object reference (IDOR) that lets an actor already holding domain administrator access reference and manipulate objects across an authorization boundary. The flaw is fixed in the Serv-U 2026-3 release and has no public exploit identified at time of analysis; SolarWinds itself reported it. Impact is reduced in Windows deployments, which tempers real-world severity despite the 9.1 CVSS score.

Privilege escalation in SolarWinds Serv-U allows an authenticated domain administrator account to abuse an insecure direct object reference (IDOR) and elevate to a system administrator, ultimately executing commands as the root user on the underlying host. The flaw affects Serv-U file transfer server deployments, with a reduced impact on Windows installations, and carries a CVSS 9.1 rating driven by a scope change from application admin to OS-level root. There is no public exploit identified at time of analysis and no CISA KEV listing, but SolarWinds self-reported and shipped a fix in the Serv-U 2026-3 release.

Stored cross-site scripting in SolarWinds Serv-U enables session hijacking and information disclosure from administrator accounts via malicious script persistence in the application. The vulnerability requires a high-privileged attacker to inject the payload, which then executes in the browser context of any administrator who views the poisoned content - a classic privilege-boundary-crossing XSS pattern confirmed by the CVSS scope-change flag. No public exploit code has been identified at time of analysis, and a vendor fix appears in Serv-U 2026.3 based on release note references.

Account takeover in SolarWinds Serv-U managed file transfer server lets an authenticated user access and hijack other users' accounts through an insecure direct object reference (CWE-639), where user-controlled identifiers are not properly authorization-checked. Any valid low-effort authenticated session can be leveraged to reach objects belonging to other accounts, with the vendor noting reduced impact on Windows deployments (implying greater exposure on non-Windows/Linux installs). No public exploit has been identified at time of analysis; the issue was reported by SolarWinds and is fixed in the Serv-U 2026-3 release.

Account takeover in SolarWinds Serv-U is enabled by an insecure direct object reference (IDOR) that lets an authenticated user hijack the SMTP/email flow and seize arbitrary accounts, per SolarWinds' own advisory. Because the flaw crosses a trust boundary (CVSS scope-changed) with high confidentiality, integrity, and availability impact, a single privileged account can be leveraged against other users' accounts; Windows deployments are described by the vendor as lower-impact. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.

Privilege escalation in SolarWinds Serv-U lets an authenticated group member elevate their access to system administrator and execute code as root on Linux/Unix deployments, with reduced impact on Windows. The root cause is improper authorization (CWE-285) reachable over the network; the vendor rates it CVSS 9.1 due to a scope change and full CIA impact, but there is no public exploit identified at time of analysis and it is not in CISA KEV. Fixed in the Serv-U 2026-3 release.

Privilege escalation in SolarWinds Serv-U managed file transfer server allows an existing domain administrator to elevate their Serv-U account from a standard user type to a full system administrator, granting complete control over the file transfer service and its data. The flaw stems from missing authorization (CWE-862) and carries a CVSS 9.1 rating, driven by a scope change and high confidentiality, integrity, and availability impact. SolarWinds notes the impact is lower in Windows deployments, and there is no public exploit identified at time of analysis.

Privilege escalation in SolarWinds Serv-U managed file transfer allows a user holding domain administrator privileges to create Serv-U system administrator accounts, crossing an authorization boundary the product is expected to enforce independently. Tracked as CVE-2026-28309 (CWE-862, Missing Authorization) and reported by SolarWinds, it carries a 9.1 CVSS due to scope change and full C/I/A impact, though the vendor notes the impact is lower in Windows deployments. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Privilege-scoped remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct object reference that lets an authenticated domain administrator reference objects outside their intended authorization boundary to run code on the host. The flaw carries a 9.1 CVSS due to network reach, scope change, and full confidentiality/integrity/availability impact, though the practical bar is high because domain administrator access is a prerequisite, and impact is reduced on Windows deployments. No public exploit is identified at time of analysis and it is not listed in CISA KEV.

Privilege escalation in SolarWinds Serv-U allows an authenticated member of a domain user group to be elevated into an administrator group, granting full administrative control over the managed file transfer server. The flaw stems from improper access control (CWE-284) and carries a vendor CVSS of 9.1 due to a scope change and full confidentiality, integrity, and availability impact, though SolarWinds notes the impact is lower on Windows deployments. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Privilege escalation in SolarWinds Serv-U allows a domain administrator to elevate to a full Serv-U system administrator, granting complete control over the managed file transfer server and its data (CVSS 9.1, CWE-284 improper access control). Exploitation requires existing domain-administrator privileges (PR:H) but no user interaction, and the vendor notes the impact is reduced on Windows deployments, implying non-Windows (Linux) installs are more severely affected. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so this is a defense-in-depth priority rather than a confirmed active threat.

Privilege-to-root remote code execution in SolarWinds Serv-U managed file transfer server stems from an insecure direct object reference (CWE-639) that an authenticated domain administrator with read/write access to the home directory can abuse to execute code as root on the underlying host. The CVSS 3.1 score of 9.1 reflects a scope change from application-admin context to full OS compromise, with the impact explicitly noted as lower on Windows deployments. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, so this is a high-severity but authentication-gated flaw rather than a mass-exploitable unauthenticated bug.

Remote code execution in SolarWinds Serv-U managed file transfer/FTP server allows an attacker to run arbitrary code remotely, executing as root on Unix/Linux deployments while impact is reduced on Windows. The flaw stems from an access-control weakness (CWE-284) and is corroborated by a vendor 'Authentication Bypass' tag, carrying a CVSS 9.1 (scope-changed) rating. No public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is currently theoretical rather than confirmed.

Privilege escalation to remote code execution as root in SolarWinds Serv-U stems from an insecure direct object reference (IDOR) that lets an authenticated group administrator manipulate object references beyond their authority. The flaw carries a CVSS 9.1 rating because a scope change allows a lower-tier admin to fully compromise the underlying host on Linux/Unix, though impact is reduced on Windows deployments. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the high privilege prerequisite (group admin) is realistic in multi-tenant MFT environments.

Remote denial-of-service in SolarWinds Serv-U allows unauthenticated attackers to crash the Serv-U service by sending specially crafted POST requests using Content-Encoding: deflate. The flaw carries a CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) and maps to CWE-400 (uncontrolled resource consumption), affecting service availability without compromising confidentiality or integrity; no public exploit identified at time of analysis.

IDOR vulnerability in SolarWinds Serv-U allows accessing objects belonging to other users. Fourth critical Serv-U vulnerability in this batch.

Second type confusion vulnerability in SolarWinds Serv-U. Different attack vector from CVE-2025-40539 but same impact — arbitrary code execution.

Type confusion vulnerability in SolarWinds Serv-U enables arbitrary code execution. Second critical Serv-U vulnerability.

Broken access control in SolarWinds Serv-U allows unauthorized user creation by exploiting privilege assignment flaws. First of four critical Serv-U vulnerabilities.

A Path Restriction Bypass vulnerability exists in Serv-U that when abused, could give a malicious actor with access to admin privileges the ability to execute code on a directory. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.

A missing validation process exists in Serv U when abused, could give a malicious actor with access to admin privileges the ability to execute code. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. This Improper Privilege Management vulnerability could allow attackers to escalate privileges to gain unauthorized elevated access.

A logic error vulnerability exists in Serv-U which when abused could give a malicious actor with access to admin privileges the ability to execute code. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

SolarWinds Serv-U is vulnerable to a client-side cross-site scripting (XSS) vulnerability. Rated low severity (CVSS 2.6), this vulnerability is remotely exploitable.

Application is vulnerable to Cross Site Scripting (XSS) an authenticated attacker with users’ permissions can modify a variable with a payload. Rated medium severity (CVSS 4.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

SolarWinds Serv-U is vulnerable to a directory traversal vulnerability where remote code execution is possible depending on privileges given to the authenticated user. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

A highly privileged account can overwrite arbitrary files on the system with log output. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

SolarWinds Serv-U was found to be susceptible to a Directory Traversal Remote Code Vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

A vulnerability has been identified within Serv-U 15.4 that allows an authenticated actor to insert content on the file share function feature of Serv-U, which could be used maliciously. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

A vulnerability has been identified within Serv-U 15.4 and 15.4 Hotfix 1 that, if exploited, allows an actor to bypass multi-factor/two-factor authentication. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

A vulnerability has been identified within Serv-U 15.4 that, if exploited, allows an actor to bypass multi-factor/two-factor authentication. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

SolarWinds Serv-U is submitting an HTTP request when changing or updating the attributes for File Share or File request. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

This vulnerability happens in the web client versions 15.3.0 to Serv-U 15.3.1. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

When a user has admin rights in Serv-U Console, the user can move, create and delete any files are able to be accessed on the Serv-U host machine. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Serv-U server responds with valid CSRFToken when the request contains only Session. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

The Serv-U File Server allows for events such as user login failures to be audited by executing a command. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerability. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.

Share/IncomingWizard.htm in SolarWinds Serv-U before 15.2.3 mishandles the user-supplied SenderEmail parameter, aka "Share URL XSS.". Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

An issue was discovered in SolarWinds Serv-U before 15.2.2. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files (that include users' password hashes) that is world readable and writable. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.

SolarWinds Serv-U File Server before 15.2.1 allows information disclosure via an HTTP response. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

SolarWinds Serv-U File Server before 15.2.1 allows XSS as demonstrated by Tenable Scan, aka Case Number 00484194. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

SolarWinds Serv-U File Server before 15.2.1 mishandles the Same-Site cookie attribute, aka Case Number 00331893. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

SolarWinds Serv-U File Server before 15.2.1 has a "Cross-script vulnerability," aka Case Numbers 00041778 and 00306421. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

A denial of service vulnerability in SolarWinds Serv-U before 15.1.6 HFv1 allows an authenticated user to crash the application (with a NULL pointer dereference) via a specially crafted URL beginning. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

SolarWinds Serv-U MFT before 15.1.6 HFv1 assigns authenticated users a low-entropy session token that can be included in requests to the application as a URL parameter in lieu of a session cookie. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.