Product by SolarWinds
SolarWinds Serv-U
56 known vulnerabilities in SolarWinds Serv-U (SolarWinds), 4 of them actively exploited (CISA KEV).
Key figures
56
Vulnerabilities
4
Actively exploited (KEV)
1
Used by ransomware
27
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2021-35211 | Serv-U Remote Memory Escape Vulnerability In CISA KEVRansomware | 9.0 | |
| Critical | CVE-2026-28318 | SolarWinds Serv-U Unauthenticated Denial of Service Vulnerability In CISA KEV | 7.5 | |
| Critical | CVE-2024-28995 | SolarWinds Serv-U L Directory Transversal Vulnerability In CISA KEV | 8.6 | |
| Critical | CVE-2021-35247 | Improper Input Validation Vulnerability in Serv-U In CISA KEV | 4.3 | |
| Critical | CVE-2026-28316 | SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability | 9.1 | |
| High | CVE-2024-45711 | SolarWinds Serv-U FTP Service Directory Traversal Remote Code Execution Vulnerability | 7.5 | |
| High | CVE-2021-35250 | Directory Transversal Vulnerability in Serv-U 15.3 | 7.5 | |
| High | CVE-2021-35223 | Execute Command Function Allows Remote Code Execution (RCE)Vulnerability | 8.5 | |
| Medium | CVE-2020-27994 | SolarWinds Serv-U: Path Traversal | 6.5 | |
| Critical | CVE-2025-40549 | SolarWinds Serv-U Path Restriction Bypass Vulnerability | 9.1 | |
| Medium | CVE-2020-28001 | SolarWinds Serv-U: Cross-Site Scripting (XSS) | 5.4 | |
| Critical | CVE-2026-28308 | SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability | 9.1 | |
| Critical | CVE-2026-28305 | SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability | 9.1 | |
| Critical | CVE-2026-28311 | SolarWinds Serv-U: security vulnerability | — | |
| Critical | CVE-2026-28304 | SolarWinds Serv-U Remote Code Execution Vulnerability | 9.1 | |
| Critical | CVE-2026-28302 | SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability | 9.1 | |
| Critical | CVE-2020-35481 | SolarWinds Serv-U: security vulnerability | 9.8 | |
| Critical | CVE-2025-40547 | SolarWinds Serv-U Logic Abuse - Remote Code Execution Vulnerability | 9.1 | |
| Critical | CVE-2026-28314 | SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability | 9.1 | |
| Critical | CVE-2026-28312 | SolarWinds Serv-U Privilege Escalation Vulnerability | 9.1 | |
| Critical | CVE-2026-28321 | SolarWinds Serv-U Broken Access Control Vulnerability | 9.1 | |
| High | CVE-2020-15576 | SolarWinds Serv-U: Information Disclosure | 7.5 | |
| Critical | CVE-2025-40548 | SolarWinds Serv-U Broken Access Control - Remote Code Execution Vulnerability | 9.1 | |
| High | CVE-2020-15574 | SolarWinds Serv-U: security vulnerability | 7.5 | |
| High | CVE-2024-28073 | SolarWinds Serv-U Directory Traversal Remote Code Execution Vulnerability | 8.4 |
News
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 29sans-atrisk-mail,
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 23sans-atrisk-mail,
- CISA Adds Actively Exploited SolarWinds Serv-U DoS Flaw to KEV Catalogthehackernews,
- SolarWinds Serv-U DoS Vulnerability Added to KEVsans-newsbites-mail,