---
id: "CVE-2021-35247"
kind: "vulnerability"
aliases: ["CVE-2021-35247"]
title: "SolarWinds Serv-U: SolarWinds Serv-U Improper Input Validation Vulnerability"
severity: "medium"
cvss: 5.3
epss: 0.03453
exploited: true
status: "open"
category: "other"
products: [{"name": "SolarWinds Serv-U", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "file-transfer", "other", "serv-u", "solarwinds"]
not_affected_if: ["unknown"]
published_at: "2022-01-10T14:10:17+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-35247", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-35247", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35247", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# SolarWinds Serv-U: SolarWinds Serv-U Improper Input Validation Vulnerability

SolarWinds Serv-U, a managed file transfer server, has an improper input validation flaw that lets attackers build and send queries without sanitization. The sources do not say what an attacker can read or change once the query goes through.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:SolarWinds Serv-U affected ? fixed ?

## Fix

Apply the updates per the vendor instructions; the fixed version is not stated in the sources.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-35247
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2021-35247
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2021-35247

## From the sources

Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization. Please Note: No downstream affect has been detected as the LDAP servers ignored improper characters. To insure proper input validation is completed in all environments. SolarWinds recommends scheduling an update to the latest version of Serv-U.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_