CISA KEV catalog
Confirmed active exploitation.
Listed in CISA's catalog of Known Exploited Vulnerabilities: attackers are using it in real attacks. Patch it with priority.
- Name
- SolarWinds Serv-U Improper Input Validation Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply updates per vendor instructions.
Description
Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization. Please Note: No downstream affect has been detected as the LDAP servers ignored improper characters. To insure proper input validation is completed in all environments. SolarWinds recommends scheduling an update to the latest version of Serv-U.
Affected products
solarwinds: serv-u
References5
- documentation.solarwinds.com/en/success_center/servu/content/re… Release NotesVendor Advisory
- www.solarwinds.com/trust-center/security-advisories/cve-2021-35… Broken LinkVendor Advisory
- documentation.solarwinds.com/en/success_center/servu/content/re… Release NotesVendor Advisory
- www.solarwinds.com/trust-center/security-advisories/cve-2021-35… Broken LinkVendor Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=… US Government Resource
Metrics
- CVSS 3.1
-
5.3
MEDIUM
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - EPSS — exploit probability
- 4% percentile: 90 · as of 2 November 2026
- CWE
- CWE-20