SolarWinds Serv-U contains an insecure direct object reference (IDOR) vulnerability classified as CWE-639, enabling an attacker with a domain admin account and read/write access to the home directory to bypass authorization controls and execute code remotely with root privileges. The vulnerability affects Serv-U installations, with reduced impact on Windows environments. The CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, scope change, and high confidentiality, integrity, and availability impacts. No vendor advisory or patch information is currently available.

Successful exploitation can lead to remote code execution with root privileges, potentially allowing full system compromise. The attacker must have a domain account with administrative privileges and read/write access to the home directory, which limits the attack surface to privileged users. The impact is lower on Windows deployments, though the exact reduction is unspecified.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict domain admin access and limit read/write permissions to the home directory to trusted users only. Monitor for suspicious activity involving privileged accounts. No official patch or workaround has been documented at this time.