CVE-2019-12181: SolarWinds Serv-U Linux privilege escalation via OS command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityCVSS 8.8 with network reachability, low privileges required, no user interaction, public exploit code and very high EPSS, though not in KEV and requiring an existing low-privileged foothold.

What it is

SolarWinds Serv-U before 15.1.7 on Linux contains an OS command injection flaw (CWE-78) that allows privilege escalation. The vulnerability is network-reachable with low privileges required and no user interaction, and public exploit code exists, making it a practical target for attackers who already hold a foothold on the host.

Impact

An attacker with low privileges can execute arbitrary OS commands and escalate to higher privileges on the affected Linux system, gaining full control of confidentiality, integrity and availability of the host.

Attack surface

Reached over the network (AV:N) with low privileges required (PR:L) and no user interaction (UI:N), per the CVSS vector. The description does not specify the exact interface or endpoint used, so the precise entry point cannot be confirmed from this record.

Exploitation

Not listed in CISA KEV, but EPSS is high (0.65981, 99.2nd percentile) and multiple references are tagged Exploit, indicating public exploit code is available. No ransomware group usage is documented.

What to do

• Upgrade SolarWinds Serv-U to 15.1.7 or later on Linux systems, per the vendor release notes.
• If immediate patching is not possible, restrict network access to the Serv-U service and limit which accounts can authenticate.
• Run the Serv-U service under a least-privileged dedicated account to reduce the impact of command execution.
• Monitor vendor advisories and apply any follow-up fixes for the Serv-U Linux privilege escalation issue.

Detection

• Audit Serv-U process trees for unexpected child processes or shell invocations (e.g., sh, bash, curl, wget) spawned by the service.
• Review Linux authentication and sudo logs for privilege changes or anomalous command execution tied to the Serv-U service account.
• Check installed Serv-U version against 15.1.7 and flag any Linux host still running an older build.
• Alert on outbound network connections originating from the Serv-U process that are not part of normal FTP/MFT traffic.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.