CVE-2026-28309: SolarWinds Serv-U Access Control Vulnerability

CVE-2026-28309 Overview

CVE-2026-28309 is a broken access control vulnerability [CWE-862] in SolarWinds Serv-U file transfer server. The flaw allows a domain administrator to create system administrator accounts, escalating privileges beyond the intended authorization boundary. SolarWinds notes the impact is lower in Windows deployments, indicating the issue affects non-Windows Serv-U installations more severely. The vulnerability carries a CVSS 3.1 base score of 9.1 and requires authenticated access at the domain administrator level to exploit. Successful exploitation grants full system-level control over the Serv-U instance, exposing hosted files, configuration data, and connected infrastructure.

Critical Impact
An authenticated domain administrator can create system administrator accounts, gaining full control over the Serv-U server and its file transfer operations.

Affected Products

SolarWinds Serv-U (versions prior to 2026.3)
SolarWinds Serv-U on non-Windows platforms (higher impact)
SolarWinds Serv-U on Windows (lower impact)

Discovery Timeline

2026-07-21 - CVE-2026-28309 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-28309

Vulnerability Analysis

CVE-2026-28309 stems from missing authorization checks in the Serv-U administrative role model. Serv-U separates administrative privileges into domain administrators and system administrators. Domain administrators manage a single Serv-U domain and its users. System administrators control the entire Serv-U instance, including all domains, global settings, and server processes.

The vulnerability allows a domain administrator to bypass the boundary between these roles. By crafting requests to account management endpoints, a domain administrator can create new accounts with the system administrator role assigned. The authorization layer fails to verify that the requesting principal holds sufficient privilege to grant system-level roles. This maps directly to CWE-862 (Missing Authorization).

SolarWinds indicates the impact is lower on Windows deployments, likely because the Windows service account model constrains what a compromised Serv-U process can do at the operating system level. Non-Windows deployments face broader exposure to file system and process manipulation once system administrator access is obtained.

Root Cause

The root cause is missing authorization enforcement on privilege assignment during account creation. The Serv-U code path that provisions administrator accounts trusts the caller's request payload without validating that the caller's own role permits granting the requested role. This is a classic vertical privilege escalation through broken access control.

Attack Vector

The attack requires an authenticated session as a domain administrator, which limits exploitation to insiders or attackers who have already compromised domain admin credentials. Once authenticated, the attacker sends a request to the administrator account creation function and specifies the system administrator role. The server accepts the request and provisions the account. The attacker then authenticates with the new credentials and inherits full instance-wide control. The attack is executed over the network against the Serv-U management interface.

Detection Methods for CVE-2026-28309

Indicators of Compromise

Unexpected new system administrator accounts appearing in Serv-U audit logs.
Administrator account creation events originating from sessions belonging to domain administrators rather than existing system administrators.
Successful logins to the Serv-U management interface from accounts that did not exist prior to the incident window.
Configuration changes to global Serv-U settings shortly after a new administrator account is created.

Detection Strategies

Review Serv-U administrative audit logs for account creation events and correlate the creating principal's role against the created principal's role.
Alert on any account creation where the creator is a domain administrator and the created account has system administrator privileges.
Baseline the expected set of system administrator accounts and generate alerts on any deviation.

Monitoring Recommendations

Forward Serv-U audit and access logs to a centralized logging platform for retention and correlation.
Monitor authentication attempts against the Serv-U administrative interface for anomalous source addresses or unusual hours.
Track file system changes in Serv-U configuration directories on non-Windows hosts where impact is highest.

How to Mitigate CVE-2026-28309

Immediate Actions Required

Upgrade SolarWinds Serv-U to version 2026.3 or later, which contains the vendor fix.
Audit all existing system administrator accounts and remove any that cannot be attributed to an authorized administrator.
Rotate credentials for all Serv-U administrator accounts after patching to invalidate any sessions or credentials created during a potential exploitation window.
Restrict access to the Serv-U management interface to trusted networks only.

Patch Information

SolarWinds addressed CVE-2026-28309 in Serv-U 2026.3. Refer to the SolarWinds Serv-U 2026.3 Release Notes and the SolarWinds Security Advisory for CVE-2026-28309 for the full remediation guidance and version details.

Workarounds

Reduce the number of accounts granted domain administrator privileges to the minimum required for operations.
Segment the Serv-U management interface behind a VPN or restricted management network to limit the population of principals who can reach the vulnerable endpoint.
Enable multi-factor authentication on all Serv-U administrator accounts to raise the cost of credential compromise.

bash

# Configuration example: restrict management interface access via host firewall (Linux)
# Allow only the administrative jump host to reach the Serv-U management port
iptables -A INPUT -p tcp --dport 43958 -s 10.0.0.10 -j ACCEPT
iptables -A INPUT -p tcp --dport 43958 -j DROP