{"id":"CVE-2021-35247","kind":"vulnerability","aliases":["CVE-2021-35247"],"related":[],"title":"SolarWinds Serv-U: SolarWinds Serv-U Improper Input Validation Vulnerability","description":"Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization. Please Note: No downstream affect has been detected as the LDAP servers ignored improper characters. To insure proper input validation is completed in all environments. SolarWinds recommends scheduling an update to the latest version of Serv-U.","summary":"SolarWinds Serv-U, a managed file transfer server, has an improper input validation flaw that lets attackers build and send queries without sanitization. The sources do not say what an attacker can read or change once the query goes through.","severity":"medium","cvss":5.3,"epss":0.03453,"exploited":true,"exploited_at":"2022-01-21T00:00:00+00:00","products":[{"name":"SolarWinds Serv-U","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","file-transfer","other","serv-u","solarwinds"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the updates per the vendor instructions; the fixed version is not stated in the sources.","status":"open","published_at":"2022-01-10T14:10:17+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:29:03+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"other","confidence":0.35,"triage":{"at":"2026-10-23T21:29:03Z","model":"claude-haiku-5-5","output":{"fix":"Apply the updates per the vendor instructions; the fixed version is not stated in the sources.","reach":"unknown","impact":"high","summary":"SolarWinds Serv-U, a managed file transfer server, has an improper input validation flaw that lets attackers build and send queries without sanitization. The sources do not say what an attacker can read or change once the query goes through.","category":"other","who_cares":["solarwinds","serv-u","file-transfer"],"confidence":0.35,"needs_auth":"unknown","worst_case":"unknown; attacker-sent queries may reach data, impact not stated in sources","analyst_note":"Find the vendor advisory and affected-version details for Serv-U 15.2.5 and earlier, plus the fixed build, via the CISA KEV entry and SolarWinds security advisories.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00046,"input_tokens":2842,"output_tokens":351,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2021':14A,17A '-35247':15A,18A 'addit':97C 'affect':105C 'allow':82C 'attack':49B,63B 'authent':80C 'build':50B 'chang':67B 'charact':83C,115C 'complet':122C 'cve':13A,16A 'detect':108C 'downstream':104C 'environ':125C 'exploit':23B 'file':25B,38B 'file-transf':24B 'flaw':46B 'goe':71B 'ignor':113C 'improp':9A,43B,114C 'input':10A,44B,93C,119C 'insur':117C 'latest':133C 'ldap':79C,111C 'let':48B 'login':76C 'manag':37B 'mechan':94C 'note':102C 'perform':96C 'pleas':101C 'proper':118C 'queri':53B,70B 'read':65B 'recommend':127C 'sanit':55B,88C,100C 'say':60B 'schedul':128C 'screen':77C 'send':52B 'serv':3A,7A,21A,29B,34B,73C,137C 'serv-u':2A,6A,20A,28B,33B,72C,136C 'server':40B,112C 'solarwind':1A,5A,31B,32B,89C,126C 'solarwinds':19A 'sourc':57B 'suffici':87C 'transfer':26B,39B 'u':4A,8A,22A,30B,35B,74C,138C 'updat':91C,130C 'valid':11A,45B,98C,120C 'version':134C 'vulner':12A 'web':75C 'without':54B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2022-01-10T14:10:17+00:00","kev":{"dateAdded":"2022-01-21","dueDate":"2022-02-04","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","cvss_by":"psirt@solarwinds.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-35247","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-35247","severity":null,"published_at":"2022-01-21T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T12:39:25+00:00","note":null},{"source":"epss","external_id":"CVE-2021-35247","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-35247","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-35247","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-35247","severity":null,"published_at":"2022-01-10T14:10:17+00:00","modified_at":"2026-06-17T03:57:22+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}