SolarWinds Serv-U suffers from a missing authorization vulnerability (CWE-862) that enables a domain administrator to escalate privileges by creating system administrator accounts. This broken access control flaw allows unauthorized privilege escalation within the product. The CVSS 3.1 base score is 9.1, indicating critical severity with network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vulnerability is published and assigned CVE-2026-28309, but no vendor remediation or patch information is currently available. The impact is noted to be lower on Windows deployments, but no further technical details or affected versions are specified.

An attacker with domain administrator privileges can exploit this vulnerability to create system administrator accounts, leading to full system compromise. This results in complete loss of confidentiality, integrity, and availability of the affected Serv-U system. The impact severity is critical given the high CVSS score and the ability to escalate privileges to system administrator level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict domain administrator privileges to trusted personnel only and monitor for unauthorized account creation. Follow vendor updates closely for patch availability.