Actively exploited in the wild
SolarWinds Serv-U Improper Input Validation Vulnerability
SolarWinds - Serv-U · Listed in the CISA KEV since 2022-01-21. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2021-35247
MediumCVSS 4.3KEVSummary
The Serv-U web login screen for LDAP authentication allowed characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization.
Risk Assessment
Improper input validation could potentially lead to security issues, though no downstream impact was detected as LDAP servers ignored improper characters.
Recommendation
Schedule an update to the latest version of Serv-U to ensure proper input validation in all environments.
Other vulnerabilities in Serv-U
See all- CVE-2025-40549Critical
Serv-U contains a Path Restriction Bypass vulnerability that, when abused, could give a malicious actor with admin privileges the ability to execute code on a directory. This issue requires administrative privileges to abuse. On Windows systems, this is scored as medium due to differences in how paths and home directories are handled.
- CVE-2025-40548Critical
Serv-U contains a missing validation process vulnerability that, when abused, could give a malicious actor with admin privileges the ability to execute code. This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as medium because services frequently run under less-privileged service accounts by default.
- CVE-2025-40547Critical
Serv-U contains a logic error vulnerability that, when abused, could give a malicious actor with admin privileges the ability to execute code. This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as medium because services frequently run under less-privileged service accounts by default.
- CVE-2023-35179High
A vulnerability has been identified within Serv-U 15.4 that allows bypassing multi-factor/two-factor authentication. The actor must have administrator-level access to Serv-U to perform this action.
Original NVD description (English source)
Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization. Please Note: No downstream affect has been detected as the LDAP servers ignored improper characters. To insure proper input validation is completed in all environments. SolarWinds recommends scheduling an update to the latest version of Serv-U.