CVE-2021-35247
Improper Input Validation Vulnerability in Serv-U
SolarWinds Serv-U Improper Input Validation Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.
Required action
Apply updates per vendor instructions.
CISA notes
https://nvd.nist.gov/vuln/detail/CVE-2021-35247
Description
Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization. Please Note: No downstream affect has been detected as the LDAP servers ignored improper characters. To insure proper input validation is completed in all environments. SolarWinds recommends scheduling an update to the latest version of Serv-U.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NExploitation Context
as of October 15, 2026- CISA added CVE-2021-35247 to the KEV catalog 14 days after its CVE record was published.
- It is one of 11 SolarWinds entries in the CISA KEV catalog, and the only one added in 2022.
- Its current EPSS score (3.5%) is higher than that of 14% of CISA KEV entries.
Affected Products
| Vendor | Product | Affected versions |
|---|---|---|
| SolarWinds | SolarWinds Serv-U | 15.2.5 and previous versions to <15.3 |
References
2 LinksRecord Details
More from SolarWinds
SolarWinds Serv-U L Directory Transversal Vulnerability
Serv-U Remote Memory Escape Vulnerability
SolarWinds Serv-U Unauthenticated Denial of Service Vulnerability
SolarWinds Web Help Desk Hardcoded Credential Vulnerability
Related
Tool categories
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.