SolarWinds Serv-U contains a missing authorization vulnerability (CWE-862) that enables a domain administrator to escalate their user privileges to that of a system administrator. This vulnerability has a high CVSS score of 9.1, indicating critical severity with network attack vector, low attack complexity, high privileges required, no user interaction, and impacts confidentiality, integrity, and availability. The impact is reduced on Windows deployments. There is no vendor advisory or patch information available at this time.

An attacker with domain administrator privileges can escalate to system administrator privileges, potentially gaining full control over the Serv-U system. This could lead to complete compromise of confidentiality, integrity, and availability of the affected system. The impact is reportedly lower on Windows deployments, but the vulnerability remains critical.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict domain administrator privileges to trusted personnel only and monitor for suspicious privilege escalations.