{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/tags/server-software/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.1,"id":"CVE-2026-28310"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Serv-U 15.5.4 HF1 and below"],"_cs_severities":["critical"],"_cs_tags":["privilege-escalation","server-software","vulnerability"],"_cs_type":"advisory","_cs_vendors":["SolarWinds"],"content_html":"\u003cp\u003eA critical privilege escalation vulnerability, identified as CVE-2026-28310, has been discovered in SolarWinds Serv-U versions 15.5.4 HF1 and earlier. This flaw allows an authenticated domain administrator to escalate their privileges to that of a system administrator, gaining full control over the Serv-U instance. The vulnerability has a CVSS v3.1 base score of 9.1, indicating its critical severity. While the issue impacts both Windows and Linux deployments of Serv-U, the overall impact is considered lower in Windows environments. This vulnerability is due to missing authorization (CWE-862) which allows an already authenticated user with domain administrator privileges to bypass security controls and obtain higher-level access. Defenders need to prioritize patching to prevent unauthorized administrative control.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker, already possessing valid domain administrator credentials for the environment where SolarWinds Serv-U is deployed, authenticates to the Serv-U application.\u003c/li\u003e\n\u003cli\u003eLeveraging the missing authorization vulnerability (CWE-862) within Serv-U, the domain administrator user exploits the flaw.\u003c/li\u003e\n\u003cli\u003eThe exploitation of CVE-2026-28310 results in the elevation of the domain administrator's user type within Serv-U to that of a system administrator.\u003c/li\u003e\n\u003cli\u003eThe now system administrator user gains full administrative control over the Serv-U application, its configurations, and potentially managed files.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-28310 grants an attacker with domain administrator privileges complete control over the compromised Serv-U application as a system administrator. This level of access could lead to unauthorized modification of server configurations, data exfiltration from files managed by Serv-U, disruption of file transfer services, or the use of the server as a platform for further internal network attacks. While the impact is stated to be lower in Windows deployments, the potential for significant unauthorized access and control remains critical for all affected organizations using Serv-U.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately patch SolarWinds Serv-U to a version beyond 15.5.4 HF1, as indicated by the SolarWinds release notes referenced in the brief for CVE-2026-28310.\u003c/li\u003e\n\u003cli\u003eReview access logs for Serv-U to identify any suspicious activity or unauthorized configuration changes made by domain administrator accounts, particularly around the time of patch deployment.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-21T16:25:43Z","date_published":"2026-07-21T16:25:43Z","id":"https://feed.craftedsignal.io/briefs/2026-07-solarwinds-serv-u-privilege-escalation/","summary":"CVE-2026-28310 describes a critical privilege escalation vulnerability (CVSS 9.1) affecting SolarWinds Serv-U versions 15.5.4 HF1 and below, allowing a domain administrator to elevate their user type to that of a system administrator, with lower impact noted in Windows deployments.","title":"SolarWinds Serv-U Privilege Escalation Vulnerability (CVE-2026-28310)","url":"https://feed.craftedsignal.io/briefs/2026-07-solarwinds-serv-u-privilege-escalation/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.1,"id":"CVE-2026-28304"},{"cvss":9.1,"id":"CVE-2026-28309"},{"cvss":9.1,"id":"CVE-2026-28306"},{"cvss":9.1,"id":"CVE-2026-28307"},{"cvss":9.1,"id":"CVE-2026-28316"},{"cvss":9.1,"id":"CVE-2026-28312"},{"cvss":9.1,"id":"CVE-2026-28313"},{"cvss":9.1,"id":"CVE-2026-28317"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Serv-U (15.5.4 HF1 and below)","Serv-U (\u003c= 15.5.4 HF1)"],"_cs_severities":["critical"],"_cs_tags":["remote-code-execution","privilege-escalation","vulnerability-exploitation","vulnerability","cve","improper-access-control","server","software-update","idor","account-takeover","server-software","access-control","server-application"],"_cs_type":"advisory","_cs_vendors":["SolarWinds"],"content_html":"\u003cp\u003eA critical remote code execution (RCE) vulnerability, identified as CVE-2026-28304, affects SolarWinds Serv-U File Transfer Protocol (FTP) server versions 15.5.4 HF1 and below. This flaw enables an attacker with high privileges to achieve arbitrary code execution remotely as the root user. While the vulnerability's impact is noted to be lower in Windows deployments, it presents a significant risk for full system compromise on other operating systems where \u0026quot;root\u0026quot; is a more powerful user. Given the nature of Serv-U, often used for critical file transfers, successful exploitation could lead to extensive data exfiltration, system integrity breaches, and service disruption. Defenders must prioritize patching to mitigate this severe risk. The specifics of the exploit, such as which high privilege allows the RCE, are not detailed in the NVD entry.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker obtains high-privilege credentials for a SolarWinds Serv-U instance or the underlying operating system.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts and sends a malicious request to the vulnerable Serv-U application.\u003c/li\u003e\n\u003cli\u003eThe Serv-U application, operating with elevated privileges, processes the malformed input.\u003c/li\u003e\n\u003cli\u003eCVE-2026-28304 is triggered, leading to a bypass of security controls and arbitrary code execution.\u003c/li\u003e\n\u003cli\u003eThe attacker's payload executes with root privileges on the host system running Serv-U.\u003c/li\u003e\n\u003cli\u003eWith root access, the attacker establishes persistence mechanisms, exfiltrates sensitive data, or disrupts critical services.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-28304 grants an attacker remote code execution capabilities with root privileges. This level of access allows for complete control over the compromised Serv-U server, leading to potential full system compromise, data exfiltration of sensitive files, installation of additional malware or backdoors, and denial-of-service. While the NVD advisory notes a lower impact on Windows deployments, the \u0026quot;as root\u0026quot; designation suggests particularly severe consequences for Linux or Unix-based Serv-U installations, where root access provides unrestricted system control. Organizations using Serv-U for mission-critical operations or storing sensitive data are at high risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately update SolarWinds Serv-U to version 15.5.4 HF2 or later to patch CVE-2026-28304, as specified in the SolarWinds advisory references.\u003c/li\u003e\n\u003cli\u003eImplement strong authentication measures and principle of least privilege for Serv-U accounts to mitigate the prerequisite of high privilege credentials for exploitation.\u003c/li\u003e\n\u003cli\u003eMonitor Serv-U application logs and system-level process creation logs (e.g., Sysmon on Windows, Auditd on Linux) for unusual activity indicating potential exploitation attempts or post-exploitation behavior.\u003c/li\u003e\n\u003cli\u003eReview firewall rules to restrict network access to Serv-U instances to only necessary source IPs and ports, reducing the attack surface for remote exploitation.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-21T16:29:51Z","date_published":"2026-07-21T16:19:10Z","id":"https://feed.craftedsignal.io/briefs/2026-07-solarwinds-serv-u-rce/","summary":"A critical remote code execution vulnerability (CVE-2026-28304) has been identified in SolarWinds Serv-U versions 15.5.4 HF1 and below, allowing an attacker with high privileges to execute arbitrary code remotely as root, posing a severe risk to affected systems, though with lower impact on Windows deployments.","title":"Remote Code Execution Vulnerability in SolarWinds Serv-U (CVE-2026-28304)","url":"https://feed.craftedsignal.io/briefs/2026-07-solarwinds-serv-u-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Server-Software","version":"https://jsonfeed.org/version/1.1"}