CVE-2026-28310: SolarWinds Serv-U Privilege Escalation

CVE-2026-28310 Overview

CVE-2026-28310 is a privilege escalation vulnerability in SolarWinds Serv-U that allows a domain administrator to elevate their user type to system administrator. The flaw is classified under [CWE-862] (Missing Authorization) and stems from insufficient authorization checks when domain-level accounts modify user type attributes. Successful exploitation grants full administrative control over the Serv-U file transfer server, exposing managed files and configurations. SolarWinds notes that the impact is lower in Windows deployments, but Linux and other platforms remain exposed to the full effect. The vulnerability affects the confidentiality, integrity, and availability of the Serv-U service and any data it manages.

Critical Impact
A domain administrator can escalate to system administrator on SolarWinds Serv-U, gaining full control over the managed file transfer environment and its data.

Affected Products

SolarWinds Serv-U (versions prior to Serv-U 2026.3)
SolarWinds Serv-U File Server deployments on Linux (higher impact)
SolarWinds Serv-U File Server deployments on Windows (reduced impact)

Discovery Timeline

2026-07-21 - CVE-2026-28310 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-28310

Vulnerability Analysis

CVE-2026-28310 is an authorization flaw in the Serv-U user management workflow. Serv-U supports multiple user tiers, including standard users, domain administrators, and system administrators. Domain administrators are scoped to manage users and settings within a single domain, while system administrators control the entire Serv-U instance. The vulnerability allows a domain administrator to modify their own account attributes to assume the system administrator role. This breaks the intended trust boundary between per-domain and global administration.

Once a domain administrator escalates, the attacker gains control over global Serv-U configuration, file transfer paths, authentication settings, and audit configuration. On Linux and comparable platforms, this control translates directly into broader system impact through Serv-U service permissions. On Windows, service isolation reduces the downstream operating system impact, though full Serv-U compromise still occurs.

Root Cause

The root cause is missing server-side authorization enforcement when a user modifies their own privilege level. The application accepts requests to change user type without verifying that the requester holds a role authorized to grant the target role. This is a classic [CWE-862] pattern where client-supplied role fields are trusted during account updates.

Attack Vector

The attack vector is network-based and requires an authenticated domain administrator account. No user interaction is needed. An attacker who already holds or compromises a domain administrator credential submits a modified user profile update that sets their user type to system administrator. Because the flaw crosses privilege boundaries, the scope is changed and the resulting access covers the entire Serv-U instance.

No verified public exploit or proof of concept is currently available. Refer to the SolarWinds Security Advisory CVE-2026-28310 for vendor technical details.

Detection Methods for CVE-2026-28310

Indicators of Compromise

Unexpected changes to user type or role attributes on Serv-U accounts, especially self-modifications by domain administrators.
New system administrator accounts appearing outside of change management windows.
Serv-U audit log entries showing role escalation events from domain administrator to system administrator.
Configuration changes to global Serv-U settings performed by accounts that were previously scoped to a single domain.

Detection Strategies

Monitor Serv-U administrative API and management console requests that update the user type field, alerting on any change that raises privilege level.
Correlate authentication events with role change events to identify accounts that escalate shortly after login from unusual sources.
Baseline the set of system administrator accounts and alert on additions or role promotions.
Review Serv-U audit logs during incident triage for privilege changes preceding sensitive file transfer activity.

Monitoring Recommendations

Ingest Serv-U application and audit logs into a centralized SIEM or data lake for retention and correlation across identity and file transfer telemetry.
Alert on outbound data transfers immediately following administrative role changes.
Track failed and successful logins to domain administrator accounts from new IP addresses or geolocations.
Review scheduled tasks, event handlers, and custom scripts inside Serv-U for unauthorized additions after any suspected escalation.

How to Mitigate CVE-2026-28310

Immediate Actions Required

Upgrade SolarWinds Serv-U to the fixed release identified in the Serv-U 2026.3 Release Notes.
Audit the list of system administrator accounts and remove any that were added without authorization.
Rotate credentials for all domain administrator and system administrator accounts on affected Serv-U instances.
Restrict network access to the Serv-U administrative interface to trusted management networks only.

Patch Information

SolarWinds addresses CVE-2026-28310 in the Serv-U 2026.3 release. Apply the upgrade on all Serv-U servers, including standby and disaster recovery nodes. Vendor guidance and release details are available in the SolarWinds Serv-U Release Notes and the SolarWinds Security Advisory CVE-2026-28310.

Workarounds

Reduce the number of accounts holding the domain administrator role until the patch is applied.
Enforce multi-factor authentication for all Serv-U administrative accounts to reduce the likelihood of credential-based escalation.
Isolate the Serv-U management interface behind a VPN or bastion host and block direct internet exposure of administrative endpoints.
Increase audit log verbosity and forward logs off-host so escalation attempts remain visible even if an attacker gains administrative access.

bash

# Example: restrict Serv-U management interface to a trusted subnet on Linux
sudo iptables -A INPUT -p tcp --dport 43958 -s 10.0.10.0/24 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 43958 -j DROP