CVE-2026-28302: SolarWinds Serv-U Privilege Escalation

CVE-2026-28302 Overview

CVE-2026-28302 is an Insecure Direct Object Reference (IDOR) vulnerability affecting SolarWinds Serv-U file transfer server [CWE-639]. The flaw allows an authenticated group administrator to escalate privileges and achieve remote code execution as root on Linux deployments. Windows deployments are affected with reduced impact because the Serv-U service does not run with equivalent system-level privileges.

SolarWinds published the fix in the Serv-U 2026.3 release. The SolarWinds Security Advisory CVE-2026-28302 documents the issue, and remediation details are covered in the SolarWinds Serv-U Release Notes.

Critical Impact
An authenticated group administrator can pivot from a scoped management role to full root-level code execution on the underlying Linux host, compromising confidentiality, integrity, and availability of the file transfer service.

Affected Products

SolarWinds Serv-U File Server (Linux deployments — highest impact)
SolarWinds Serv-U File Server (Windows deployments — reduced impact)
Serv-U versions prior to 2026.3

Discovery Timeline

2026-07-21 - CVE-2026-28302 published to the National Vulnerability Database
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-28302

Vulnerability Analysis

CVE-2026-28302 is an Insecure Direct Object Reference weakness in Serv-U's management interface. The application exposes internal object identifiers to authenticated group administrators without enforcing ownership or scope checks on the referenced objects. An attacker with valid group administrator credentials can substitute object identifiers in administrative requests to reach objects and configuration entities outside of the group they are authorized to manage.

Because Serv-U configuration objects can drive service behavior, tampering with out-of-scope objects lets the attacker alter file paths, execution hooks, or event handlers that Serv-U evaluates with elevated privileges. On Linux hosts, the Serv-U service typically runs as root, so successful abuse translates directly to arbitrary code execution as root. On Windows, service isolation and account configuration reduce the resulting privilege level.

Root Cause

The root cause is missing authorization on object identifiers passed to administrative endpoints [CWE-639]. The application authenticates the group administrator role but does not validate that the requested object belongs to the caller's administrative scope. This design gap permits horizontal and vertical privilege escalation through direct identifier manipulation.

Attack Vector

Exploitation is network-based and requires prior group administrator authentication. An attacker with such access sends crafted administrative requests referencing global or cross-group object identifiers. The Serv-U backend processes those references without a scope check, allowing modification of privileged configuration and, in turn, code execution in the Serv-U service context. Public proof-of-concept code is not available at the time of publication.

Detection Methods for CVE-2026-28302

Indicators of Compromise

Administrative API requests from group administrator accounts referencing object identifiers outside of their assigned group scope.
Unexpected changes to Serv-U global configuration, event handlers, or file execution rules created or modified by non-global administrator accounts.
New child processes spawned by the Serv-U service (Serv-U, servudaemon) that do not match normal file transfer workloads, particularly shells or interpreters on Linux.

Detection Strategies

Enable verbose Serv-U administrative auditing and alert on write operations performed by group administrators that target objects outside their delegated scope.
Baseline the Serv-U service process tree and alert on deviations, especially the execution of /bin/sh, /bin/bash, python, or perl as a child of the Serv-U daemon.
Correlate Serv-U administrative sessions with subsequent host-level process, file, and network activity to surface post-authentication escalation chains.

Monitoring Recommendations

Forward Serv-U application logs, HTTP access logs, and host telemetry to a central analytics platform for cross-source correlation.
Monitor outbound network connections initiated by the Serv-U service account for signs of reverse shells or tooling downloads.
Track administrative account inventory and alert on unexpected creation, promotion, or password resets of group administrator accounts.

How to Mitigate CVE-2026-28302

Immediate Actions Required

Upgrade Serv-U to version 2026.3 or later on all Linux and Windows deployments.
Audit existing group administrator accounts and remove or disable any that are unnecessary or inactive.
Rotate credentials for remaining group administrator accounts and enforce multi-factor authentication where supported.
Review recent Serv-U configuration changes for unauthorized modifications made by group administrators.

Patch Information

SolarWinds addresses CVE-2026-28302 in Serv-U 2026.3. Refer to the SolarWinds Serv-U 2026.3 Release Notes for installation guidance and to the SolarWinds Security Advisory CVE-2026-28302 for scope and impact details.

Workarounds

Restrict the Serv-U management interface to trusted administrative networks using firewall rules or a VPN.
On Linux hosts, run the Serv-U service under a dedicated, non-root account where the deployment supports it, to limit the blast radius of a successful exploit.
Minimize the number of accounts holding the group administrator role and apply least-privilege delegation until patching is complete.

bash

# Configuration example: restrict Serv-U management port (default 43958) to a trusted admin subnet
iptables -A INPUT -p tcp --dport 43958 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 43958 -j DROP