Do Son 
TL;DR
SolarWinds fixed three critical SolarWinds Serv-U vulnerabilities on July 21, 2026. They allow privilege escalation and remote code execution on the file transfer server. SolarWinds rates each one 9.1 critical, and all need existing privileges to abuse.
Why it matters
Serv-U handles managed file transfers for many enterprises. So a compromise can expose sensitive data fast. Managed file transfer tools are prime targets for data theft and extortion. These SolarWinds Serv-U vulnerabilities hit Linux hardest, since the advisory notes lower impact on Windows. Serv-U also has a rough track record. Attackers, including the Clop gang, have abused older Serv-U bugs before. Internet scans have counted over 12,000 exposed Serv-U servers this year. That exposure makes patching a priority even for internal servers.
How the attacks work
CVE-2026-28307: privilege escalation
This flaw lets a domain user group climb into an administrator group. As a result, a low-tier account gains admin power inside Serv-U. The escalation stays inside the application’s own permission model.
CVE-2026-28308: IDOR to RCE
An insecure direct object reference can lead to remote code execution. An IDOR flaw lets a user reach objects they should not access. However, it requires domain administrator access first.
CVE-2026-28321: broken access control
Weak access checks allow arbitrary file read and write. From there, an attacker can escalate and run code as root. Root-level code execution would give near-total control of the host. This one also needs domain admin rights.
Affected versions
The bugs affect Serv-U 15.5.4 HF1 and below. The fixed release, Serv-U 2026.3, resolves all three at once. Notably, all three need existing privileges, so they are not unauthenticated. Still, an attacker who steals credentials could chain them toward full control.
Exploitation status and patch
Researchers reported the bugs through the Intigriti bug bounty program. So far, no public exploit or in-the-wild abuse has been confirmed. First, upgrade to Serv-U 2026.3 now. If you cannot upgrade at once, restrict admin and domain access tightly. Also, keep Serv-U off the open internet where possible. With three critical SolarWinds Serv-U vulnerabilities now public, prompt patching is the safe move.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
