SolarWinds Serv-U contains an IDOR vulnerability (CWE-639) that allows an attacker with domain administrator access to bypass authorization controls via a user-controlled key. This flaw can result in remote code execution. The vulnerability is critical, with a CVSS 3.1 base score of 9.1, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and complete confidentiality, integrity, and availability impact. The impact is reportedly reduced on Windows platforms. No vendor advisory or patch information is available at this time.

Successful exploitation allows an attacker with domain administrator privileges to execute arbitrary code remotely, potentially compromising confidentiality, integrity, and availability of the affected system. The impact severity is critical, but the requirement for domain administrator access limits the attack surface. Windows deployments experience a lower impact, though specifics are not detailed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict domain administrator access to trusted personnel only and monitor for unusual activity related to Serv-U. No official remediation or temporary fixes have been published by SolarWinds at this time.