External risk intelligence

SolarWinds Serv-U Broken Access Control Allows Arbitrary File Read Write and Privilege Escalation.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-28321

SolarWinds Serv-U is a managed file transfer service commonly deployed as an internet-facing gateway or edge service to facilitate file exchanges. While this specific vulnerability requires domain administrator access, the product itself is typically positioned at the network perimeter, making it a likely target for internet-based interaction.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in SolarWinds Serv-U software, which could allow unauthorized access to read or write files, potentially leading to privilege escalation and code execution. While requiring administrator access and having a reduced impact on Windows systems, the nature of Serv-U as a file exchange gateway positioned at the network perimeter warrants attention to confirm relevance and exposure.

Broken access control allows unauthorized file actions.
SolarWinds Serv-U is a common internet-facing gateway.
Confirm if this affects your organization's systems.

Attack Path

How an attacker could exploit the issue

An attacker with domain administrator access could exploit a broken access control vulnerability in SolarWinds Serv-U to create a new system administrator account. This elevated access can then be used to execute arbitrary code on the underlying system, leading to privilege escalation and potentially a full system compromise. The impact is lessened on Windows installations where Serv-U services typically run with fewer privileges.

Requires domain administrator access.
Triggers via privilege escalation to create accounts.
Leads to arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in SolarWinds Serv-U could allow an attacker with domain administrator access to read or write arbitrary files, potentially leading to elevated privileges and code execution. The impact may be reduced on Windows systems.

Domain administrator credentials.
Arbitrary file read/write access.
Privilege escalation and code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and infrastructure or platform teams are likely responsible for addressing this vulnerability in SolarWinds Serv-U. The first practical step is to identify all Serv-U instances, confirm their exposure and criticality, and then determine the accountable owner for remediation planning.

Application owners should manage the issue.
Verify Serv-U instance exposure and criticality.
Plan remediation or vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is SolarWinds Serv-U?

SolarWinds Serv-U is a managed file transfer solution designed to securely move files across a network. It is frequently deployed as an edge service or internet-facing gateway, acting as a central hub where organizations exchange data with external partners and clients.

What does broken access control mean for CVE-2026-28321?

Broken access control, identified as CWE-284, occurs when a system fails to properly enforce restrictions on what users can do. In this case, the flaw allows someone with certain access to perform file read and write operations they should not be permitted to perform, creating a path to escalate privileges and execute unauthorized code.

How is this vulnerability triggered?

The vulnerability requires an attacker to already possess domain administrator credentials to initiate the exploit. It is not triggered by casual web requests or unauthorized external users without those high-level permissions. Note that the functional impact is lower on systems running Windows, where the service typically operates with more constrained privileges.

Do I need to worry about this if my Serv-U is internal?

While the vulnerability requires elevated credentials, Halo Surface Signal notes that Serv-U is frequently positioned at the network perimeter to facilitate file exchanges. If your instance is internet-facing, it is a more likely target. You should prioritize assessing the exposure of any Serv-U gateways that bridge your internal network to the outside world.

When should I take action to address this issue?

You should begin by locating all Serv-U deployments within your environment to understand your footprint. Once identified, confirm which instances are internet-facing and verify their criticality. Work with the designated application owners to evaluate the potential risk and coordinate necessary vendor updates or security configurations.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.