Critical File Server Vulnerability: SolarWinds Serv-U Patches Root RCE Flaws (CVE-2026-28304)
Executive Summary
SolarWinds has issued an urgent security advisory and emergency updates for its popular enterprise multi-protocol file server platform, SolarWinds Serv-U. The updates address two critical vulnerabilities, tracked as CVE-2026-28304 and CVE-2026-28311, both carrying a high-severity CVSS score of 9.1 out of 10.
The most dangerous of the two, CVE-2026-28304, is an unauthenticated Remote Code Execution (RCE) vulnerability that enables an attacker to execute arbitrary OS commands with full root or SYSTEM privileges on the hosting server. SolarWinds Serv-U is widely deployed across enterprise environments, government agencies, and defense contractors to manage high-volume FTP, SFTP, and FTPS file transfers containing sensitive corporate data and trade secrets. Because Serv-U instances are frequently exposed directly to the public internet to facilitate external file exchanges, these vulnerabilities present an immediate threat of full perimeter breach, data exfiltration, and ransomware deployment.
Deep-Dive Technical Analysis
The vulnerabilities affect SolarWinds Serv-U versions 15.5.4 HF1 and below, stemming from memory management defects and unsafe input parsing within Serv-U's web management and protocol processing engines:
* CVE-2026-28304 (Unauthenticated Remote Code Execution - CVSS 9.1): This flaw exists due to inadequate sanitization of user-supplied buffer data in incoming protocol requests handled by the Serv-U HTTP/SFTP listener. An unauthenticated remote attacker can construct a malicious payload that triggers a memory corruption/buffer overflow condition. This allows the attacker to hijack execution flow and execute arbitrary shell commands within the security context of the Serv-U service process, which typically runs with root or SYSTEM privileges.
* CVE-2026-28311 (Authenticated/Domain Admin RCE - CVSS 9.1): This flaw allows an authenticated domain or application administrator to manipulate internal application settings and configuration files, leading to arbitrary code execution and application override.
* Exploitation Impact: Successful exploitation of CVE-2026-28304 gives an attacker an unauthenticated root shell on the host server. The attacker can read, modify, or exfiltrate all stored files and directories, plant persistent web shells, dump memory to harvest credentials, and pivot laterally into internal corporate networks.
Industry Impact and Recommendations / Mitigations
File transfer appliances are prime targets for extortion syndicates and nation-state threat actors because they house critical business intellectual property and serve as trusted bridges between external partners and internal networks.
Recommended Mitigation Steps:
* Update Serv-U Immediately: All administrators running SolarWinds Serv-U versions 15.5.4 HF1 or earlier must immediately upgrade to version 15.5.4 HF2 or higher as provided in the SolarWinds Trust Center.
* Isolate Public File Servers: Ensure Serv-U servers are placed in isolated Demilitarized Zones (DMZs), preventing direct lateral network connections from the file server to internal Active Directory controllers or internal database subnets.
* Enforce Principle of Least Privilege: Configure the Serv-U system daemon/service to run under a dedicated, low-privilege service account rather than root or NT AUTHORITY\SYSTEM.
* Monitor Logs for Indicator of Compromise (IoC): Inspect Serv-U service logs, web server logs, and process execution trees for spawned child processes (such as cmd.exe, powershell.exe, or /bin/sh) originating from the Serv-U parent process.
References:
* Multiple Critical Vulnerabilities in SolarWinds Serv-U - CSA Singapore Advisory
* SolarWinds Trust Center Security Advisory - CVE-2026-28304