SolarWinds Serv-U contains a broken access control vulnerability (CWE-284) that permits an attacker possessing domain administrator access to perform arbitrary file read and write operations. These capabilities can be leveraged to escalate privileges and execute code with root-level permissions. The vulnerability has a CVSS 3.1 base score of 9.1, indicating critical severity. The impact is noted to be lower on Windows platforms. No vendor advisory or patch information is currently available, and no known exploits in the wild have been reported.

An attacker with domain administrator privileges can exploit this vulnerability to read and write arbitrary files on the affected system, potentially escalating privileges to root and executing arbitrary code. This poses a critical risk to system confidentiality, integrity, and availability. The impact is reduced on Windows installations but remains significant on other platforms.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict domain administrator access to trusted personnel only and monitor for suspicious activity related to file access and privilege escalation attempts.