SolarWinds · Serv-U
CVE-2024-28995
SolarWinds Serv-U L Directory Transversal Vulnerability
Exploited in attacks
High 8.6 Attack chance: 99.6%
What it is
SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine.
CISA: SolarWinds Serv-U contains a path traversal vulnerability that allows an attacker access to read sensitive files on the host machine.
What to do
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: August 7, 2024
More exploited flaws from SolarWinds
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Jun 5, 2026 | Uncontrolled Resource Consumption | Serv-U | High 7.5 | 44% |
| Jan 21, 2022 | Improper Input Validation | Serv-U | Medium 4.3 | 3.5% |
| Nov 3, 2021 | Remote Code Execution | Serv-U | Critical 9.0 | 91% |
| Mar 9, 2026 | Deserialization of Untrusted Data | Web Help Desk | Critical 9.8 | 90% |
| Feb 12, 2026 | Security Control Bypass | Web Help Desk | High 8.1 | 74% |
| Feb 3, 2026 | Deserialization of Untrusted Data | Web Help Desk | Critical 9.8 | 84% |
| Oct 15, 2024 | Hardcoded Credential | Web Help Desk | Critical 9.1 | 93% |
| Aug 15, 2024 | Deserialization of Untrusted Data | Web Help Desk | Critical 9.8 | 85% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.