CVE-2021-35247VulnerabilityPublished 01/21/2022Updated 10/24/2026
CVE-2021-35247: SolarWinds Serv-U Improper Input Validation Vulnerability
Affects SolarWinds Serv-USource CISA KEV
Severity
HighNo CVSS score published yet
- Exploitation
Actively exploited – in CISA KEV since 01/21/2022
- KEV deadline
- 02/04/2022
- EPSS
- 3.5% chance of exploitation in 30 days – higher than 88% of CVEs
What to do
CISA required action
Apply updates per vendor instructions.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| SolarWinds Serv-U | Affected
| Fixed in– |
Description
SolarWinds Serv-U versions 15.2.5 and earlier have an improper input validation vulnerability that allows attackers to send unsanitized queries. This vulnerability has been exploited in the wild. No specific patch information is provided in the available data.