SolarWinds Serv-U Flaws Allow Account Takeover, Privilege Escalation, and RCE

SolarWinds disclosed and patched multiple high-severity vulnerabilities in Serv-U that can let authenticated attackers take over accounts, escalate privileges, read and write arbitrary files, and in some cases achieve remote code execution as root. The issues affect Serv-U 15.5.4 HF1 and earlier on both Windows and Linux, with SolarWinds noting the impact is generally more severe on Linux and lower on Windows. The vendor fixed the flaws in Serv-U 2026.3 and said the vulnerabilities were reported through the Intigriti bug bounty program.

The disclosed CVEs include broken access control, privilege escalation, and IDOR weaknesses such as CVE-2026-28321 for arbitrary file read/write that can be leveraged into code execution, CVE-2026-28312 and CVE-2026-28310 for elevation to system administrator, CVE-2026-28309 for creating system administrator accounts, and CVE-2026-28313, CVE-2026-28314, CVE-2026-28316, and CVE-2026-28317 for account takeover, SMTP hijacking, and further privilege escalation. SolarWinds said the bugs require existing privileges rather than unauthenticated access, but warned that stolen or low-tier credentials could be chained to gain full control of a Serv-U host; no public exploits or confirmed in-the-wild abuse had been reported at disclosure.