CVE-2021-35247mediumunder attackCWE-20

CVE-2021-35247: medium-severity vulnerability in SolarWinds Serv-U

Improper Input Validation Vulnerability in Serv-U

Published · Updated

Follow this CVE+ Monitor Serv-U

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

43Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Attendcvss 4.3epss 3.6%
from disclosure to weapon
Published on NVDJan 7
CISA KEV+14d
Action required by CISAfederal deadline: 2022-02-04

Apply updates per vendor instructions.

In short

The Serv-U web login screen accepted unsanitized characters when authenticating users through LDAP, potentially allowing attackers to bypass security checks or cause unexpected behavior. While LDAP servers typically ignore malformed input, the vulnerability could be exploited in certain configurations.

Technical detail

This improper input validation vulnerability (CWE-20) affects the LDAP authentication mechanism in Serv-U's web interface. An unauthenticated attacker can send specially crafted input containing insufficiently sanitized characters to the login screen; although most LDAP servers reject such input, certain configurations or downstream systems may process it unexpectedly, potentially leading to authentication bypass or injection attacks.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization. Please Note: No downstream affect has been detected as the LDAP servers ignored improper characters. To insure proper input validation is completed in all environments. SolarWinds recommends scheduling an update to the latest version of Serv-U.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Affected products
SolarWinds · Serv-U
Related CVEs — SolarWinds Serv-U

In the same product, most dangerous first.

CVE-2026-28318HIGHSolarWinds Serv-U Unauthenticated Denial of Service VulnerabilityEPSS 43.7%KEVCVE-2021-35250HIGHDirectory Transversal Vulnerability in Serv-U 15.3EPSS 12.8%CVE-2024-45711HIGHSolarWinds Serv-U FTP Service Directory Traversal Remote Code Execution VulnerabilityEPSS 6.3%CVE-2021-35223HIGHExecute Command Function Allows Remote Code Execution (RCE)VulnerabilityEPSS 2.9%CVE-2026-28316CRITICALSolarWinds Serv-U Insecure Direct Object Reference (IDOR) VulnerabilityEPSS 2.1%CVE-2025-40549CRITICALSolarWinds Serv-U Path Restriction Bypass VulnerabilityEPSS 1.1%