SolarWinds Serv-U contains an authorization bypass vulnerability classified as CWE-639, specifically an insecure direct object reference (IDOR). This flaw allows an attacker with domain administrator privileges to escalate their privileges further within the system. The vulnerability is less impactful on Windows deployments. The CVSS 3.1 base score is 9.1, reflecting critical severity with network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No official remediation or patch information is currently available.

An attacker with domain administrator access can exploit this vulnerability to escalate privileges, potentially gaining unauthorized control or access beyond their initial permissions. The impact on confidentiality, integrity, and availability is high. However, the vulnerability requires already elevated privileges to exploit, and the impact is reduced in Windows environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is provided, organizations should monitor SolarWinds advisories for updates. Given the requirement for domain administrator access, limiting and monitoring such privileged accounts is advisable until a patch is available.