SolarWinds Serv-U contains a privilege escalation vulnerability (CVE-2026-28307) where a domain user group can be improperly elevated to an administrator group due to inadequate access control mechanisms. This vulnerability is categorized under CWE-284 (Improper Access Control). The CVSS v3.1 score is 9.1, indicating a critical severity with network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The impact is reportedly reduced on Windows deployments. No official remediation or patch information is available from the vendor at this time.

Successful exploitation allows an attacker with domain user group privileges to escalate to administrator group privileges, potentially leading to full system compromise. The vulnerability affects confidentiality, integrity, and availability of the affected system. The impact is less severe on Windows deployments but remains critical overall.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict domain user group privileges where possible and monitor for suspicious privilege escalation attempts. Follow any guidance provided by SolarWinds once an advisory is published.