Read the docs
TI-2021-07527 Aliases CVE-2021-25276GHSA-j64g-p5ch-94rp

In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile…

Priority LOW 32CWE-732Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files (that include users' password hashes) that is world readable and writable. An unprivileged Windows user (having access to the server's filesystem) can add an FTP user by copying a valid profile file to this directory. For example, if this profile sets up a user with a C:\ home directory, then the attacker obtains access to read or replace arbitrary files with LocalSystem privileges.

Why it matters now

EPSS 0.00473 41st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:solarwinds:serv-u:*:*:*:*:*:*:*:*before 15.2.2VulnerableSolarWinds
cpe:2.3:a:solarwinds:serv-u:15.2.2:-:*:*:*:*:*:*15.2.2VulnerableSolarWinds
  • cpe:2.3:a:solarwinds:serv-u:*:*:*:*:*:*:*:* Versions before 15.2.2 Vulnerable ·SolarWinds
  • cpe:2.3:a:solarwinds:serv-u:15.2.2:-:*:*:*:*:*:* Versions 15.2.2 Vulnerable ·SolarWinds

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-25276
  2. 2026-10-03 Alias added: GHSA-j64g-p5ch-94rp

References

Exploit 1

  • TI-2021-14105 Serv-U Remote Memory Escape Vulnerability KEVCVSS 3.1CRITICAL 10.0
  • TI-2024-19183 SolarWinds Serv-U L Directory Transversal Vulnerability KEVCVSS 3.1HIGH 8.6
  • TI-2026-22619 SolarWinds Serv-U Unauthenticated Denial of Service Vulnerability KEVCVSS 3.1HIGH 7.5
  • TI-2021-14139 Improper Input Validation Vulnerability in Serv-U KEVCVSS 3.1MEDIUM 5.3
  • TI-2024-30693 SolarWinds Serv-U FTP Service Directory Traversal Remote Code Execution Vulnerability CVSS 3.1HIGH 8.8
  • TI-2021-14142 Directory Transversal Vulnerability in Serv-U 15.3 CVSS 3.1HIGH 7.5
See all 54 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences