SolarWinds Serv-U 2026.3 Patches 16 Vulnerabilities (CVE-2026-28302 to CVE-2026-28321) Including Root RCE, IDOR-Chained Privilege Escalation, and Broken Access Control
SolarWinds Serv-U 2026.3 Patches 16 Vulnerabilities (TL-2026-1625), also tracked as Serv-U 2026.3 IDOR/Privilege-Escalation Batch, is a critical-severity software vulnerability scored CVSS 9.1, first published 2026-07-22. It has no confirmed attribution, affects SolarWinds Serv-U MFT Server, references 16 CVEs (CVE-2026-28302, CVE-2026-28304, CVE-2026-28305), maps to 20 MITRE ATT&CK techniques (T1005, T1059, T1068), and is covered by 9 detection rules and 20 indicators of compromise.
Key facts for TL-2026-1625
- Threat ID
- TL-2026-1625
- Also known as
- Serv-U 2026.3 IDOR/Privilege-Escalation Batch, Serv-U Root RCE Chain
- Severity
- CRITICAL
- CVSS
- 9.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-07-22
- Last reviewed
- 2026-07-22
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, managed-file-transfer-users, enterprise-it, government administration, finance, health
- Target regions
- Global, North America, Europe
- Detection rules
- 9
- Indicators of compromise
- 20
SolarWinds released Serv-U 2026.3 on 2026-07-21, fixing 16 vulnerabilities in the managed file-transfer product, 15 of which are CVSS 9.1 CRITICAL. Most chain insecure direct object references (IDOR) and broken access control into privilege escalation from domain-admin/group-admin to system-administrator, several of which culminate in remote code execution as root on Linux-based installations; one flaw is a CVSS 6.2 stored XSS enabling session hijacking. No active exploitation or public PoC has been documented for this batch, but Serv-U has a recent history of in-the-wild exploitation (CVE-2026-28318 DoS, added to CISA KEV in June 2026).
How SolarWinds Serv-U 2026.3 Patches 16 Vulnerabilities works
On 2026-07-21, SolarWinds shipped Serv-U 2026.3, a security-focused release addressing 16 vulnerabilities in its Serv-U managed file transfer server and gateway software. Fifteen of the sixteen flaws (CVE-2026-28302, 28304-28317, 28321) carry a CVSS v3.1 base score of 9.1 (Critical); the sixteenth, CVE-2026-28315, is a stored cross-site scripting flaw rated 6.2 (Medium). Fifteen of the sixteen CVEs were responsibly disclosed through the Intigriti bug bounty program; CVE-2026-28315 was reported separately.
The critical cluster is dominated by insecure direct object reference (IDOR) and broken access control weaknesses (CVE-2026-28302, 28305, 28308, 28313, 28314, 28316, 28317, 28321) combined with privilege-escalation logic flaws (CVE-2026-28306, 28307, 28309, 28310, 28312) and two flaws SolarWinds classifies directly as remote code execution (CVE-2026-28304, 28311). Exploitation of the most severe chains requires an attacker to already hold some level of authenticated access — domain administrator, group administrator, or an authenticated domain-user account — as a starting foothold. From that position, the IDOR and access-control flaws let an attacker bypass object-level authorization checks to escalate a domain-admin or group-admin account to full system-administrator, then abuse system-administrator functionality (e.g., account/profile configuration, file management APIs) to execute arbitrary commands as root on Linux-based Serv-U deployments. CVE-2026-28309 specifically allows a domain administrator to create unauthorized system-administrator accounts, and CVE-2026-28321 (broken access control) permits arbitrary file read and write, which is itself sufficient for code execution via web-writable paths or configuration tampering. CVE-2026-28313 chains an IDOR into SMTP-relay hijacking, enabling account takeover via intercepted or forged outbound mail (e.g., password-reset interception). CVE-2026-28314 and CVE-2026-28316/28317 enable authenticated-user account takeover and further privilege escalation through insecure object references. CVE-2026-28315, the lone non-critical finding, is a stored XSS that can be used to hijack administrator sessions or exfiltrate admin-panel information.
All versions of Serv-U prior to 2026.3 are affected; 2026.3 (released 2026-07-21) is the fixed version. As of publication, no vendor advisory, CISA KEV entry, or public researcher writeup documents active exploitation or a public proof-of-concept for the 2026.3 batch, distinguishing it from the separate, actively-exploited CVE-2026-28318 (unauthenticated denial-of-service via crafted `Content-Encoding: deflate` POST requests) that SolarWinds patched in Serv-U 15.5.4 Hotfix 1 on 2026-06-03 and that CISA added to its Known Exploited Vulnerabilities catalog on 2026-06-05 with a federal remediation deadline of 2026-06-19. Shodan-indexed exposure for Serv-U at the time of the CVE-2026-28318 KEV addition was approximately 12,000+ internet-facing instances, indicating a comparably large exposed attack surface for any of the newly disclosed authenticated-privilege-escalation chains once a foothold (e.g., stolen domain-admin credentials, a prior IDOR, or a phished domain-user account) is obtained. SolarWinds Serv-U has a documented recurring pattern of privilege-escalation vulnerabilities, with a structurally similar flaw (CVE-2025-40538) patched in version 15.5.4.
Defenders should treat the 2026.3 update as urgent given: (1) the sheer count of CVSS 9.1 findings in a single release, (2) the demonstrated real-world targeting of Serv-U (CVE-2026-28318 KEV entry, active exploitation as of June 2026), (3) the low bar for the escalation chains once any authenticated foothold exists (a single compromised domain-user or domain-admin credential is a viable starting point), and (4) the root-level code-execution outcome on Linux hosts, which typically run Serv-U as a high-value file-transfer chokepoint holding sensitive customer/partner data.
MITRE ATT&CK techniques used in TL-2026-1625
Collection
T1005 Data from Local System; T1114 Email Collection
Execution
T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution
Privilege Escalation
T1068 Exploitation for Privilege Escalation; T1078 Valid Accounts; T1548 Abuse Elevation Control Mechanism
Discovery
T1069 Permission Groups Discovery; T1087 Account Discovery
Command and Control
T1071 Application Layer Protocol
Defense Evasion
Persistence
T1098 Account Manipulation; T1136 Create Account; T1505 Server Software Component
Initial Access
T1133 External Remote Services; T1190 Exploit Public-Facing Application
defense-impairment
T1222 File and Directory Permissions Modification
Impact
T1499 Endpoint Denial of Service; T1531 Account Access Removal
Credential Access
Affected products and versions in SolarWinds Serv-U 2026.3 Patches 16 Vulnerabilities
- SolarWinds — Serv-U MFT Server
Vulnerable versions: all versions prior to 2026.3
Fixed in: 2026.3 - SolarWinds — Serv-U Gateway
Vulnerable versions: all versions prior to 2026.3
Fixed in: 2026.3
Remediation for SolarWinds Serv-U 2026.3 Patches 16 Vulnerabilities
Patches
- SolarWinds Serv-U 2026.3 (released 2026-07-21) — fixes CVE-2026-28302, 28304-28317, 28321.
- SolarWinds Serv-U 15.5.4 Hotfix 1 (released 2026-06-03) — fixes the separate, actively-exploited CVE-2026-28318 DoS flaw.
Immediate actions
- Upgrade all SolarWinds Serv-U instances (MFT server and gateway) to version 2026.3 or later immediately.
- Audit domain-administrator, group-administrator, and system-administrator account lists for unauthorized or unexpected accounts created via CVE-2026-28309-style abuse.
- Rotate credentials for all Serv-U domain-admin, group-admin, and privileged domain-user accounts as a precaution against pre-patch compromise.
- Review Serv-U SMTP relay configuration and mail logs for signs of hijacking related to CVE-2026-28313.
- Restrict network exposure of the Serv-U management interface to trusted management networks / VPN only; do not expose administrative interfaces directly to the internet.
Workarounds
- Where immediate patching is not possible, restrict Serv-U administrative and web-client interfaces to trusted IP ranges via firewall/ACL.
- For the related CVE-2026-28318 DoS flaw, block inbound POST requests containing a 'Content-Encoding' header at the reverse proxy/WAF layer as an interim mitigation.
Longer-term hardening
- Deploy EDR/host monitoring on Linux Serv-U hosts to detect anomalous root-level process execution originating from the Serv-U service account.
- Implement network segmentation isolating file-transfer infrastructure from core identity/domain-admin trust boundaries.
- Establish a recurring patch-validation cadence for SolarWinds Serv-U given its recurring history of critical privilege-escalation and RCE disclosures (CVE-2025-40538, CVE-2026-28318, this 2026.3 batch).
- Enable and centrally collect Serv-U audit/activity logs for correlation with SIEM detections covering account creation, permission changes, and file read/write on sensitive paths.
CVEs associated with SolarWinds Serv-U 2026.3 Patches 16 Vulnerabilities
CVE-2026-28302CVE-2026-28304CVE-2026-28305CVE-2026-28306CVE-2026-28307CVE-2026-28308CVE-2026-28309CVE-2026-28310CVE-2026-28311CVE-2026-28312CVE-2026-28313CVE-2026-28314CVE-2026-28315CVE-2026-28316CVE-2026-28317CVE-2026-28321
Weaknesses (CWE) in SolarWinds Serv-U 2026.3 Patches 16 Vulnerabilities
CWE-639, CWE-284, CWE-269, CWE-79, CWE-306, CWE-434
Timeline of SolarWinds Serv-U 2026.3 Patches 16 Vulnerabilities
- SolarWinds publishes security advisories covering vulnerabilities in Serv-U (versions before 15.5.4 HF1) and Web Help Desk (versions before 2026.2), including CVE-2026-28318 and CVE-2026-28299.
- SolarWinds releases Serv-U 15.5.4 Hotfix 1, patching the unauthenticated denial-of-service vulnerability CVE-2026-28318.
- CISA adds CVE-2026-28318 to the Known Exploited Vulnerabilities (KEV) catalog after confirming active in-the-wild exploitation, setting a federal remediation deadline of 2026-06-19.
- Multiple outlets (BleepingComputer, Help Net Security, SecurityWeek, Integrity360, Canadian Centre for Cyber Security AV26-549) publish coverage and mitigation guidance for the actively exploited CVE-2026-28318, noting ~12,000+ internet-exposed Serv-U instances via Shodan.
- CISA BOD 22-01 remediation deadline for federal civilian agencies to patch CVE-2026-28318 expires.
- SolarWinds releases Serv-U 2026.3, patching 16 vulnerabilities (CVE-2026-28302, 28304-28317, 28321), 15 of which are rated CVSS 9.1 Critical; 15 were reported via the Intigriti bug bounty program.
- TL-Intel-Harness ingests and triages the disclosure as a tracked CRITICAL threat (TL-2026-1625) based on CVSS 9.1 severity, wide MFT deployment, and Serv-U's recent active-exploitation history.
- Cyber Security News and Cyberpress independently publish technical breakdowns of the Serv-U 2026.3 fixes, detailing the domain-admin-to-root escalation chain on Linux installations.
Sources cited for SolarWinds Serv-U 2026.3 Patches 16 Vulnerabilities
- SolarWinds Patches Serv-U Flaws
- Critical SolarWinds Serv-U Vulnerabilities Allow Remote Code Execution as Root
- Serv-U 2026.3 Release Notes
- CISA: Hackers now exploit SolarWinds Serv-U flaw to crash servers
- SolarWinds security advisory (AV26-549) - Update 1
- CISA: Patch actively exploited SolarWinds Serv-U DoS vulnerability (CVE-2026-28318)
- SolarWinds Serv-U Vulnerability Exploited in the Wild
- SolarWinds Serv-U and Web Help Desk Denial of Service (CVE-2026-28318, CVE-2026-28299): Unauthenticated Service Crash via Crafted Requests
- SolarWinds: CISA Warns of Exploited SolarWinds Serv-U Vulnerability
- Security Advisory: SolarWinds Serv-U Vulnerabilities
Threats related to SolarWinds Serv-U 2026.3 Patches 16 Vulnerabilities
- CVE-2026-56155: Microsoft AD FS Elevation-of-Privilege Vulnerability Actively Exploited
- RefluXFS: Linux Kernel XFS Copy-on-Write Race Condition Local Privilege Escalation (CVE-2026-64600)
- Apache Syncope Patches 12 CVEs Including Groovy Sandbox Bypass RCE and Audit Search SQLi
- Node.js Patches 11 Security Flaws Across v22.23.2, v24.18.1, v26.5.1 (HTTP/2 DoS, Permission Model Bypass, TLS/mTLS Issues)
- CVE-2026-20262: Cisco Catalyst SD-WAN Manager (vManage) Arbitrary File Upload Flaw Exploited as Zero-Day for Root Privilege Escalation
- Critical Meta IDOR Flaw in Support Case Infrastructure Exposed Customer Emails, Transcripts, and Internal Notes (Meta Horizon Managed Solutions / Meta.com Support)
Detection coverage for TL-2026-1625
As of 2026-07-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1625 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.