SolarWinds Serv-U contains a broken access control vulnerability (CWE-284) that permits an attacker with domain administrator access to read and write arbitrary files. This flaw can be leveraged to escalate privileges and execute code with root-level permissions. The vulnerability has a CVSS 3.1 score of 9.1, indicating critical severity. The impact is noted to be lower on Windows systems. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

An attacker with domain administrator access can exploit this vulnerability to perform arbitrary file read and write operations, potentially leading to privilege escalation and execution of code as root. This could compromise the confidentiality, integrity, and availability of affected systems. The impact is reduced on Windows installations but remains critical overall.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation has been disclosed, organizations should monitor SolarWinds advisories closely and restrict domain administrator access to trusted personnel only until a patch is available.