My organisation uses Serv-U. The permissions in our programdata folder matches the article (we've not applied the most recent Serv-U patch which came out quite

My organisation uses Serv-U. The permissions in our programdata folder matches the article (we've not applied the most recent Serv-U patch which came out quite recently). But as the article says you need to be RDP'd to the server which for us would be Administrators. Who already have control over the server. Also we don't run the service as local system just as a regular service account with no admin rights. So while this is a vulnerability it doesn't seem overly critical in our case. If you let non-privileged users RDP to your application servers and you're running as local system then sure, it's pretty bad.