SolarWinds Patches 15 Critical Serv-U Flaws That Could Hand Attackers Root Access

SolarWinds has released important security updates for its Serv-U file transfer software, addressing 15 vulnerabilities that could allow attackers to gain elevated privileges and, in some cases, execute code with root user access.

These fixes were delivered in Serv-U version 2026.3, published on July 21, 2026, as part of the company’s ongoing effort to resolve high-risk flaws reported through its bug bounty program.

The patched vulnerabilities are tracked under multiple CVE identifiers, including CVE-2026-28302 through CVE-2026-28321. They are largely rated with a severity score of 9.1, indicating critical risk. Many of these issues arise from insecure direct object reference (IDOR) weaknesses and broken access control mechanisms.

They could enable authenticated attackers, particularly those with domain or administrative access, to escalate privileges, manipulate application behavior, and ultimately execute arbitrary code with root-level permissions.

Two of the most severe vulnerabilities, CVE-2026-28304 and CVE-2026-28311, involve remote code execution. Successful exploitation could allow attackers to run malicious commands on affected systems remotely.

Other vulnerabilities enable privilege escalation by promoting lower-level users or groups to system administrator roles, effectively bypassing intended access restrictions.

SolarWinds Patches Serv-U Vulnerabilities

In addition to privilege escalation, certain flaws could lead to account takeover and SMTP hijacking. For instance, CVE-2026-28313 allows attackers to exploit an IDOR issue to compromise user accounts through SMTP manipulation.

Another vulnerability, CVE-2026-28315, involves stored cross-site scripting, which could expose sensitive administrative session data or lead to session hijacking.

SolarWinds noted that many of these vulnerabilities require some level of authenticated access, such as a domain administrator account or group-level permissions.

However, in real-world environments, attackers often chain such vulnerabilities after an initial compromise, making these issues particularly dangerous in enterprise deployments.

The company also stated that the impact is typically lower in Windows environments compared to Linux systems, where root-level execution poses a greater risk. In addition to vulnerability fixes, Serv-U 2026.3 introduces various security and usability improvements.

Content Security Policies have been strengthened to reduce the risk of code injection attacks, and new security headers, such as Cross-Origin policies and Permissions-Policy, have been implemented or made configurable. The update also includes OpenSSL 3.0.21 for enhanced cryptographic security and performance.

Additional enhancements include expanded multi-factor authentication support for Active Directory and LDAP users, improved file-sharing workflows, and greater client reliability. These updates aim to enhance both the security posture and operational efficiency of the platform.

SolarWinds credited the Intigriti bug bounty program for responsibly disclosing the vulnerabilities and collaborating on remediation.

The company urges all users to upgrade to Serv-U 2026.3 immediately, especially since older versions are nearing the end of their lifecycle and will no longer receive security updates.

Given the combination of critical vulnerabilities and the widespread enterprise use of Serv-U in managed file transfer environments, timely patching is essential to prevent potential exploitation and minimize risk exposure.

The Privilege Paths Attackers See That You Don’t: BeyondTrust Pathfinder Platform Does It for You -> Get Free Identity Security Assessment