SolarWinds Serv-U contains an authorization bypass vulnerability classified as CWE-639 (Authorization Bypass Through User-Controlled Key). This insecure direct object reference allows an attacker with domain administrator privileges to escalate their privileges further. The vulnerability affects Serv-U deployments, with a noted lower impact on Windows environments. The CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), reflecting network attack vector, low complexity, high privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

An attacker with domain administrator access can exploit this vulnerability to escalate privileges, potentially gaining higher control over the affected system. The vulnerability impacts confidentiality, integrity, and availability at a high level. The impact is less severe on Windows deployments, but still critical overall.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or mitigation is documented, organizations should monitor SolarWinds advisories for updates. Restrict domain administrator access and apply the principle of least privilege to reduce risk until a patch is available.