Loading vulnerability…
Privilege Escalation via Broken Access Control in SolarWinds Serv-U
CVE-2026-28309 is a missing authorization vulnerability in SolarWinds Serv-U 15.5.4 HF1 and earlier on Windows and Linux. An authenticated Serv-U domain administrator can bypass the intended administrative privilege boundary and create Serv-U system administrator accounts. The vulnerability is rated Critical with a CVSS v3.1 score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). Impact is lower in Windows deployments.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation escalates an authenticated domain administrator to system administrator privileges within Serv-U, potentially causing high impacts to confidentiality, integrity, and availability. The impact is lower on Windows deployments. Operating-system code execution is not specifically established for this vulnerability.
If you can’t patch tonight, do this now.
Review and restrict Serv-U domain administrator assignments and limit network exposure of administrative functionality to trusted administrators. These measures reduce exposure but do not correct the authorization flaw; upgrading remains necessary.
Patch, then assume compromise.
Upgrade SolarWinds Serv-U to version 2026.3 or a later fixed release.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.