CVE-2026-28316

This is a flaw in Serv-U that can let someone with an already powerful account turn that access into control of the entire server. It is like giving a building manager’s keycard the unintended ability to open the security-control room and operate every lock in the building.

This matters to you if you run SolarWinds Serv-U for managed file transfers. An attacker must already possess a valid domain account that Serv-U has granted administrator access; it does not require someone to click a link or open a file.

An attacker with an existing Serv-U domain administrator account can use this weakness to take over the hosting server and run commands with the highest level of access. Treat this as urgent because the resulting server control can affect files, services, and other systems reachable from that server. There is no confirmed public exploitation or CISA Known Exploited Vulnerabilities listing at this time.

Confirm exposure by identifying all SolarWinds Serv-U installations, their installed versions, and the domain accounts assigned administrator privileges. Upgrade affected installations to Serv-U 2026.3; the findings do not identify branch-specific fixes or documented breaking changes, so review the vendor release notes and test the upgrade in a non-production environment where practical.

If upgrading is delayed, immediately restrict Serv-U domain administrator access to only necessary named accounts, remove stale or shared privileged accounts, and review the systems those accounts can access. No CISA KEV remediation due date applies because this CVE is not listed in KEV. Monitor Serv-U and host logs for administrator-account activity, unexpected command execution, new privileged accounts, and unusual changes to server files or configuration.

CVE-2026-28316 is rated CVSS 9.1 Critical (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) and is classified as CWE-639, insecure direct object reference. The network-reachable issue requires a valid Serv-U domain account with administrator access and no user interaction; successful exploitation enables system-level command execution, including root privileges, with reduced impact on Windows deployments. CISA KEV does not list this CVE, no clear dated in-the-wild exploitation claim is reported, and no public exploit code is on record. EPSS estimates a 2.1% likelihood of exploitation and the trend is flat.