Critical SolarWinds Serv-U Vulnerabilities Allow Remote Code Execution as Root

SolarWinds has disclosed 15 vulnerabilities in its Serv-U managed file transfer software, with 14 rated Critical (CVSS 9.1) and capable of chaining privilege escalation into full remote code execution as root on Linux deployments.

The flaws were patched in Serv-U 2026.3, released July 21, 2026, following coordinated disclosure through the Intigriti Bug Bounty Program.

The vulnerability cluster is dominated by Insecure Direct Object Reference (IDOR) and privilege escalation bugs that allow domain administrators or group administrators to elevate themselves to system administrator status.

Critical SolarWinds Serv-U Vulnerabilities

Tracked as CVE-2026-28302, CVE-2026-28304 through CVE-2026-28312, CVE-2026-28313, CVE-2026-28314, and CVE-2026-28316 through CVE-2026-28317, plus CVE-2026-28321, each carries a CVSS score of 9.1.

A separate stored cross-site scripting flaw, CVE-2026-28315, rated 6.2 Medium, can lead to session hijacking or admin-account information disclosure.

Most critical CVEs require an attacker to already hold domain administrator, group administrator, or authenticated domain-user privileges as a starting foothold rather than being exploitable pre-authentication.

From that position, attackers can abuse IDOR flaws (CVE-2026-28302, CVE-2026-28305, CVE-2026-28308, CVE-2026-28316, CVE-2026-28317, CVE-2026-28321) to bypass access controls on internal object references, escalating to system administrator and ultimately executing arbitrary commands as root on Linux-based Serv-U installations.

Broken access control issues (CVE-2026-28309, CVE-2026-28321) permit creation of unauthorized system administrator accounts or arbitrary file read/write, further enabling code execution.

Notably, SolarWinds states the impact is consistently lower on Windows deployments, indicating the root-level compromise path is specific to Linux/Unix installations where the Serv-U service runs with root privileges.

This pattern mirrors previously disclosed Serv-U flaws such as CVE-2025-40538, a broken access control bug that similarly let attackers with domain or group admin privileges create system admin users and execute code as root, patched in version 15.5.4.

It also follows CVE-2026-28318, a separate unauthenticated denial-of-service flaw patched in June 2026 that CISA confirmed was being actively exploited in the wild.

Additional Vulnerability

Beyond privilege escalation, several CVEs enable more targeted attacks:

• CVE-2026-28313 enables SMTP hijacking leading to arbitrary account takeover via IDOR
• CVE-2026-28314 allows account takeover for authenticated users through insecure object references
• CVE-2026-28306, CVE-2026-28307, and CVE-2026-28310 focus on elevating domain administrators or user groups to system administrator status
• CVE-2026-28311 lets a domain administrator manipulate application behavior to trigger remote code execution

Serv-U 2026.3 addresses all 15 CVEs alongside hardened Content Security Policies, a newly configurable Permissions-Policy restricted to system administrators, and an updated OpenSSL 3.0.21 for underlying cryptographic security.

Organizations running any earlier version, particularly Linux-based deployments where root-level compromise is most severe, should prioritize immediate upgrade to 2026.3.

Given Serv-U’s history of active exploitation, including nation-state activity tied to earlier zero-days and the recently exploited DoS flaw CVE-2026-28318.

Defenders should treat this batch of privilege-escalation chains as a high-priority patching target, especially for internet-facing or multi-tenant Serv-U deployments where domain admin accounts may already be compromised via phishing or credential stuffing.

Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.