SolarWinds Serv-U contains an IDOR vulnerability (CWE-639) that can be exploited by an authenticated user with domain administrator privileges to escalate to system administrator privileges and execute commands as root. The vulnerability affects the authorization mechanism through a user-controlled key, leading to privilege escalation. The vulnerability is rated critical with a CVSS 3.1 score of 9.1, indicating network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch available at this time, and the vulnerability is not known to be exploited in the wild.

Successful exploitation allows an attacker with a domain administrator account to escalate privileges to system administrator and execute commands as the root user, potentially compromising the entire system. The impact on Windows deployments is lower but still significant. This could lead to full system compromise and loss of confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict domain administrator access to trusted users only and monitor for suspicious activity related to Serv-U. No official fix or temporary workaround has been published by the vendor at this time.