SolarWinds Serv-U suffers from a missing authorization (CWE-862) vulnerability that permits a domain administrator to escalate privileges by creating system administrator accounts. This broken access control flaw enables unauthorized privilege escalation, potentially compromising system security. The vulnerability has a CVSS 3.1 base score of 9.1, indicating critical severity with network attack vector, low attack complexity, high privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

Successful exploitation allows a domain administrator to create system administrator accounts, resulting in full system compromise including confidentiality, integrity, and availability impacts. The impact severity is critical, though it is noted to be lower on Windows deployments. This could lead to unauthorized administrative control over the affected Serv-U system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict domain administrator privileges to trusted personnel only and monitor for suspicious account creation activities. Follow vendor updates closely for any forthcoming patches or mitigations.