CVE-2026-28321

This is a permissions flaw in Serv-U that lets someone with a powerful administrator account bypass normal limits on which files they may access or change. It is like giving a building manager’s key the ability to open every locked room, alter records, and take control of the whole building.

This matters to you if you run Serv-U for managed file transfers. An attacker must already hold valid domain administrator credentials; the impact is lower when Serv-U runs on Windows.

A person who obtains a domain administrator account can use this flaw over the network to take full control of the Serv-U system. Treat this as urgent because that level of access can expose or alter the files your business relies on, although no confirmed active exploitation is reported.

Confirm whether Serv-U is installed, identify its version, and determine which domain administrator accounts can authenticate to it. Upgrade to Serv-U 2026.3, the vendor’s listed fixed release; no branch-specific alternative or breaking-change guidance is provided in the findings.

If the upgrade must wait, tightly restrict domain administrator access, remove unused accounts, rotate credentials for accounts that may be exposed, and limit network access to the Serv-U host to trusted administration networks. Review host and Serv-U records for unexpected file reads, writes, privilege changes, or newly created administrator accounts. CISA has not added this CVE to its Known Exploited Vulnerabilities catalog, so there is no CISA remediation due date.

CVE-2026-28321 is CVSS 9.1 Critical (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), CWE-284 broken access control. A network-authenticated domain administrator can conduct arbitrary file read/write and escalate to root; Windows installations have reduced impact. No public exploit code or clear dated report of in-the-wild exploitation is recorded, and the CVE is not in CISA KEV. EPSS is 0.6% (46th percentile) with a flat trend.