CVE-2026-28307: SolarWinds Serv-U Privilege Escalation

CVE-2026-28307 Overview

CVE-2026-28307 is a privilege escalation vulnerability in SolarWinds Serv-U file transfer software. The flaw allows a domain user group to be elevated into an administrator group, granting attackers full administrative control over the Serv-U instance. SolarWinds notes the impact is lower on Windows deployments. The weakness is classified under [CWE-284] Improper Access Control and affects Serv-U versions prior to 2026.3.

Critical Impact
An authenticated attacker with high privileges can elevate a domain user group into administrators, resulting in confidentiality, integrity, and availability compromise with scope change beyond the vulnerable component.

Affected Products

SolarWinds Serv-U (versions prior to 2026.3)
SolarWinds Serv-U File Server
SolarWinds Serv-U Managed File Transfer Server

Discovery Timeline

2026-07-21 - CVE-2026-28307 published to the National Vulnerability Database
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-28307

Vulnerability Analysis

SolarWinds Serv-U enforces access control by mapping directory group memberships to Serv-U roles. The vulnerability breaks this boundary. A domain user group can be assigned administrator privileges within Serv-U without proper authorization checks. This produces a privilege escalation path from an authenticated tenant into full administrator scope, changing the security scope beyond the Serv-U process itself.

The attack is exploitable over the network and requires no user interaction. The attacker must hold high privileges to trigger the flaw, which typically means an existing authenticated Serv-U account with directory management functions. Successful exploitation yields administrative control over file transfer configuration, user accounts, event actions, and stored credentials.

Root Cause

The root cause is improper access control [CWE-284] in the group-to-role assignment logic. Serv-U does not adequately verify that a caller is authorized to place a domain user group into the administrator role. This authorization gap allows privilege boundaries between standard domain users and Serv-U administrators to collapse.

Attack Vector

An attacker interacts with Serv-U over the network using an account that can manage domain group mappings. The attacker modifies group assignments so that a controlled domain user group is placed into the administrator group. Any member of that domain group then inherits administrator rights on Serv-U. SolarWinds indicates that Windows deployments experience reduced impact, likely due to differences in how domain group resolution is performed on that platform. Refer to the SolarWinds Security Advisory CVE-2026-28307 for vendor-specific technical detail.

// No verified public exploit code is available for CVE-2026-28307.
// The vulnerability is described in vendor documentation only.

Detection Methods for CVE-2026-28307

Indicators of Compromise

Unexpected additions of domain user groups to the Serv-U administrator group in configuration files or the Serv-U management console.
New administrator accounts appearing in Serv-U audit logs without an approved change ticket.
Modifications to Users.Archive or Serv-U group configuration timestamps outside change windows.
Successful administrator logins from domain accounts that previously held only user-level Serv-U access.

Detection Strategies

Baseline the current Serv-U administrator group membership and alert on any change to that membership.
Monitor Serv-U event logs for Group Modified and role reassignment events, correlating actor identity against an approved administrator list.
Compare directory group membership snapshots over time to identify privilege drift into Serv-U administrator scope.

Monitoring Recommendations

Forward Serv-U audit logs and Windows Security Event logs to a centralized SIEM or data lake for correlation.
Alert on file transfer configuration changes performed shortly after group membership modifications.
Track authentication events for accounts newly granted Serv-U administrator scope for 30 days after the change.

How to Mitigate CVE-2026-28307

Immediate Actions Required

Upgrade Serv-U to version 2026.3 or later as documented in the SolarWinds Serv-U Release Notes.
Audit the current membership of the Serv-U administrator group and remove any unexpected domain group assignments.
Rotate credentials for Serv-U administrator accounts and any service accounts referenced by Serv-U event actions.
Restrict network access to the Serv-U administration interface to trusted management subnets only.

Patch Information

SolarWinds addresses CVE-2026-28307 in Serv-U 2026.3. The fix corrects the access control check on group-to-role assignment so that unauthorized elevation of a domain user group into the administrator group is rejected. Review the SolarWinds Serv-U Release Notes and the SolarWinds Security Advisory CVE-2026-28307 before deploying the update.

Workarounds

Remove domain group-based administrator assignments and use local Serv-U administrator accounts protected by multi-factor authentication until the patch is applied.
Enforce least privilege on accounts that can manage Serv-U group mappings, limiting the number of users with high-privilege access.
Segment the Serv-U management port from general user networks using firewall rules or a reverse proxy with authentication.

bash

# Verify installed Serv-U version on Windows
reg query "HKLM\SOFTWARE\RhinoSoft.com\Serv-U" /v Version

# Verify installed Serv-U version on Linux
/opt/Serv-U/Serv-U -v

# After upgrade, confirm administrator group membership matches approved baseline
type "C:\ProgramData\RhinoSoft\Serv-U\Users.Archive" | findstr /I "Administrator"