SolarWinds Fixes 15 Critical Serv-U Flaws That Could Lead to Root Access

SolarWinds has released Serv-U 2026.3 to fix 16 security vulnerabilities in its managed file transfer software. Fifteen carry a critical CVSS score of 9.1, while one stored cross-site scripting flaw has a medium-severity score of 6.2.

The vulnerabilities affect Serv-U 15.5.4 HF1 and earlier versions. According to the official Serv-U 2026.3 release notes, successful attacks could result in privilege escalation, account takeover, arbitrary file access, remote code execution, or commands running as the root user on Linux servers.

Most of the critical flaws involve insecure direct object references, broken access controls, or improperly restricted administrative functions. Several require an attacker to have a domain administrator, group administrator, or other privileged Serv-U account. However, these requirements may still make the bugs useful during an intrusion after attackers obtain initial credentials.

Serv-U Vulnerabilities Affect Access Controls and Administrative Functions

The update addresses CVE-2026-28302 through CVE-2026-28317, with some numbers absent from the sequence, as well as CVE-2026-28321. SolarWinds credited researchers working through the Intigriti bug bounty program for reporting most of the vulnerabilities.

CVE-2026-28304 is one of the most serious issues. The CVE-2026-28304 vulnerability record describes a network-accessible flaw that can allow remote execution of arbitrary code as root. It has a CVSS 3.1 score of 9.1 and does not require user interaction, although the published scoring vector indicates that high privileges are required.

CVE-2026-28311 can also lead to remote code execution. In this case, a domain administrator can modify application behavior in a way that permits code execution. SolarWinds says the impact of both flaws is lower on Windows deployments because the resulting execution context differs from root-level execution on Linux.

Fifteen Critical Flaws and One Medium-Severity XSS Issue

CVE	Vulnerability type	Potential impact	Required access	Severity
CVE-2026-28302	IDOR	Privilege escalation and root code execution	Group administrator	Critical, 9.1
CVE-2026-28304	Improper access control	Remote code execution as root	High privileges	Critical, 9.1
CVE-2026-28305	IDOR	Remote code execution as root	Domain administrator with home-directory read and write access	Critical, 9.1
CVE-2026-28306 to CVE-2026-28312	Privilege escalation, IDOR, and broken access control	System administrator access or code execution	Varies by vulnerability	Critical, 9.1 each
CVE-2026-28313	IDOR	SMTP hijacking and arbitrary account takeover	Not specified in the public description	Critical, 9.1
CVE-2026-28314	IDOR	Account takeover	Authenticated user	Critical, 9.1
CVE-2026-28315	Stored cross-site scripting	Administrator session hijacking or information disclosure	Depends on payload delivery and administrator interaction	Medium, 6.2
CVE-2026-28316 and CVE-2026-28317	IDOR	System administrator privileges or further privilege escalation	Domain administrator	Critical, 9.1 each
CVE-2026-28321	Broken access control	Arbitrary file read and write, privilege escalation, and root code execution	Domain administrator	Critical, 9.1

CVE-2026-28313 targets Serv-U’s handling of object references and SMTP-related settings. The official CVE-2026-28313 record says the weakness can support SMTP hijacking and arbitrary account takeover. Such access could help an attacker impersonate users or interfere with account-related email processes.

CVE-2026-28315 is the only vulnerability in the group that SolarWinds rated below critical. It allows stored cross-site scripting that could expose information from an administrator account or hijack an authenticated administrator session.

The remaining critical issues largely allow users with domain-level or group-level authority to cross security boundaries. An attacker could create system administrator accounts, promote users or groups, change application behavior, or gain access to protected files.

Arbitrary File Access Could Create a Path to Root

CVE-2026-28321 illustrates the wider impact of the access-control failures. The flaw can give a domain administrator arbitrary read and write access to files, creating a path to privilege escalation and root code execution. The CVE-2026-28321 entry confirms that Serv-U 15.5.4 HF1 and earlier releases on Windows and Linux are affected.

Arbitrary file writing is especially dangerous on a Linux file-transfer server. Depending on Serv-U’s permissions and configuration, an attacker may be able to alter scripts, configuration files, startup components, or other files that a privileged process later loads.

SolarWinds states that the impact is generally lower on Windows installations. Administrators should not interpret that statement as meaning Windows deployments are safe. Account takeover, unauthorized administrative changes, file manipulation, and code execution can still produce serious consequences.

Why Authentication Requirements Do Not Remove the Risk

Many of these flaws require significant Serv-U privileges. This limits direct exploitation by anonymous internet users, but it does not eliminate the threat. Attackers commonly obtain credentials through phishing, password reuse, credential-stealing malware, exposed secrets, or the compromise of another account.

Once inside Serv-U, an attacker could use an access-control flaw to move from limited administrative rights to system-level control. This can turn a compromised application account into broader control over the underlying server and its transferred data.

Managed file transfer systems often process sensitive business files and communicate with internal systems. A compromised Serv-U server could therefore expose confidential data, provide a foothold for lateral movement, or allow attackers to tamper with files exchanged between trusted organizations.

Serv-U 2026.3 Adds More Security Improvements

SolarWinds released Serv-U 2026.3 on July 21, 2026. In addition to the CVE fixes, the Serv-U update hardens Content Security Policy settings and adds Cross-Origin-Embedder-Policy, Cross-Origin-Resource-Policy, and Cross-Origin-Opener-Policy headers.

The release makes Permissions-Policy configurable by system administrators and updates OpenSSL to version 3.0.21. It also extends multi-factor authentication to Microsoft Active Directory and LDAP users, adding another layer of protection for externally managed accounts.

Serv-U 2026.3 adds support for Red Hat Enterprise Linux 9 and CentOS 9. It also includes file-sharing workflow changes, browser compatibility fixes, and reliability improvements for the Serv-U Client.

How Administrators Should Respond

Organizations running Serv-U 15.5.4 HF1 or an earlier release should upgrade to Serv-U 2026.3 as soon as operationally possible. Internet-facing and partner-accessible installations should receive priority because file-transfer servers often accept connections from outside the corporate network.

• Inventory all Serv-U MFT and Serv-U FTP Server installations.
• Check the installed version and identify systems running 15.5.4 HF1 or earlier.
• Back up the Serv-U configuration before starting the upgrade.
• Install Serv-U 2026.3 and confirm that services restart correctly.
• Test FTP, SFTP, HTTPS, automation, LDAP, Active Directory, and file-sharing functions.
• Review domain, group, and system administrator accounts for unexpected changes.
• Rotate credentials if logs or account records indicate suspicious activity.
• Restrict the management interface to trusted networks or administrative hosts.
• Enable multi-factor authentication for supported account types.

Security teams should also review Serv-U logs, operating-system events, recently modified configuration files, administrator creation events, and unexplained SMTP changes. Unexpected file writes by the Serv-U service account deserve particular attention.

Administrators using Serv-U 15.5.1 or earlier face an additional lifecycle concern. SolarWinds ended active engineering support for those versions in February 2026 and plans to end technical support in November 2026. Moving to the current release addresses both the newly disclosed flaws and the approaching end-of-life deadline.

FAQ