Loading vulnerability…
Privilege Escalation in SolarWinds Serv-U
CVE-2026-28312 is a critical privilege escalation vulnerability in SolarWinds Serv-U affecting versions 15.5.4 HF1 and earlier on Windows and Linux. The flaw allows an attacker with existing high privileges in Serv-U, such as group-level administrative access, to elevate a group's permissions to system administrator. On Linux deployments, successful exploitation can further enable execution with root privileges. Available reporting associates the issue with improper authorization and broken access control conditions.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows escalation from an existing privileged Serv-U role to system administrator. In Linux environments, the vulnerability can also lead to code execution as root, creating a path to full compromise of the host, including loss of confidentiality, integrity, and availability. The impact is described as lower on Windows deployments, but still includes unauthorized privilege elevation within the application.
If you can’t patch tonight, do this now.
Apply the released SolarWinds Serv-U updates immediately. Until patching is completed, restrict and review privileged Serv-U roles and group administrative assignments, minimize exposure of administrative functionality, and audit permission structures for excessive or unnecessary delegated access. Because exploitation appears to require existing elevated access, organizations should reduce the number of accounts with group or domain administrative privileges and closely monitor administrative actions in Serv-U.
Patch, then assume compromise.
Upgrade SolarWinds Serv-U to the vendor-fixed release, specifically Serv-U 2026.3 or later, and apply the latest security updates published on 2026-07-21. Systems running Serv-U 15.5.4 HF1 and earlier should be prioritized for patching, particularly Linux deployments due to the potential for root-level execution.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.