Improper Input Validation Vulnerability in Serv-U
Priority HIGH 81Exploited in the wildCWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization. Please Note: No downstream affect has been detected as the LDAP servers ignored improper characters. To insure proper input validation is completed in all environments. SolarWinds recommends scheduling an update to the latest version of Serv-U.
Why it matters now
Exploitation Active In CISA KEV since 2022-01-21CISA due date 2022-02-04
EPSS 0.03642 89th percentileScored 2026-11-07
Fix Fixed Serv-U (SolarWinds): 15.3
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SolarWinds | Serv-U | 15.2.5 and previous versions to before 15.3 | 15.3 | Patch available | CNA |
- Serv-U VendorSolarWinds Affected 15.2.5 and previous versions to before 15.3 Fixed in 15.3 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:solarwinds:serv-u:*:*:*:*:*:*:*:* | before 15.3 | Vulnerable | SolarWinds |
- cpe:2.3:a:solarwinds:serv-u:*:*:*:*:*:*:*:* Versions before 15.3 Vulnerable ·SolarWinds
Remediation
- Fix · CNA Serv-U (SolarWinds) Fixed in 15.3
Timeline
- 2022-01-21 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2021-35247
- 2026-10-03 Alias added: GHSA-jqwj-9jvg-583v
References
More SolarWinds Serv-u vulnerabilities
- TI-2021-14105 Serv-U Remote Memory Escape Vulnerability KEVCVSS 3.1CRITICAL 10.0
- TI-2024-19183 SolarWinds Serv-U L Directory Transversal Vulnerability KEVCVSS 3.1HIGH 8.6
- TI-2026-22619 SolarWinds Serv-U Unauthenticated Denial of Service Vulnerability KEVCVSS 3.1HIGH 7.5
- TI-2024-30693 SolarWinds Serv-U FTP Service Directory Traversal Remote Code Execution Vulnerability CVSS 3.1HIGH 8.8
- TI-2021-14142 Directory Transversal Vulnerability in Serv-U 15.3 CVSS 3.1HIGH 7.5
- TI-2026-22617 SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability CVSS 3.1CRITICAL 9.1
Sources
- CVE-2021-35247 · CVE Program
- CVE-2021-35247 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-jqwj-9jvg-583v · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences