Live › vulnerability › CVE-2021-35247
Go to dashboardSolarWinds Serv-U, a managed file transfer server, has an improper input validation flaw that lets attackers build and send queries without sanitization. The sources do not say what an attacker can read or change once the query goes through.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| SolarWinds Serv-U | vendor | – | – |
Unknown from the sources.
Apply the updates per the vendor instructions; the fixed version is not stated in the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization. Please Note: No downstream affect has been detected as the LDAP servers ignored improper characters. To insure proper input validation is completed in all environments. SolarWinds recommends scheduling an update to the latest version of Serv-U.
This page as .md · .json · in your agent: get_signal("CVE-2021-35247")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.