SolarWinds Serv-U contains an authorization bypass vulnerability (CWE-639) identified as CVE-2026-28316. This IDOR flaw permits an attacker with a domain administrator account to escalate privileges to system administrator and execute commands as root. The vulnerability affects the product's authorization controls, allowing unauthorized access to sensitive functions. The severity is critical with a CVSS score of 9.1, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The impact is noted to be lower on Windows deployments. No vendor advisory or patch information is currently available.

An attacker with a domain administrator account can exploit this vulnerability to escalate privileges to system administrator and execute arbitrary commands as the root user, potentially leading to full system compromise. The vulnerability severely impacts confidentiality, integrity, and availability of the affected system. The risk is critical due to the high level of access gained. The impact is reportedly lower on Windows deployments, but still significant.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict domain administrator account usage and monitor for suspicious activity related to Serv-U. No official remediation or temporary fix has been documented at this time.