# CVE-2021-35247: SolarWinds Serv-U Improper Input Validation Vulnerability

Source: https://junglewise.ai/threats/cve-2021-35247-solarwinds-serv-u-improper-input-validation-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-01-21. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2021-35247 · Severity: critical · CVSS 5.3 · Exploited in the wild · Published 2022-01-21

The SolarWinds Serv-U web login screen failed to sufficiently sanitize characters used in LDAP authentication. This improper input validation allowed attackers to build and send unsanitized queries, though the vendor noted that many LDAP servers ignored the improper characters.

Technologies: [SolarWinds Serv-U](https://junglewise.ai/threats/technologies/serv-u). Vendors: [SolarWinds](https://junglewise.ai/threats/vendors/solarwinds).

## Quick answers

**Is CVE-2021-35247 exploited in the wild?** Yes. CVE-2021-35247 is known to be exploited in the wild, first recorded on 21 January 2022. Treat it as urgent.

**How severe is CVE-2021-35247?** Critical severity, with a CVSS score of 5.3, published 21 January 2022.

**Which products and versions are affected?** SolarWinds Serv-U <= 15.2.5.

**Is there a fix for CVE-2021-35247?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2021-35247 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2021-35247?** Check whether you run SolarWinds Serv-U. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- SolarWinds Serv-U <= 15.2.5

## Timeline

- 2022-01-18: disclosed: Initial disclosure by SolarWinds regarding LDAP input validation improvements.
- 2022-01-21: kev added: Added to CISA's Known Exploited Vulnerabilities Catalog.
- 2022-01-21: advisory: NVD publication date.
- 2022-01-21: exploited: Reported as exploited in the wild.

## Related threats

- [SolarWinds Serv-U broken access control privilege escalation](https://junglewise.ai/threats/cve-2026-28321-solarwinds-serv-u-broken-access-control-privilege-escalation)
- [SolarWinds Serv-U privilege escalation via IDOR](https://junglewise.ai/threats/cve-2026-28317-solarwinds-serv-u-privilege-escalation-via-idor)
- [SolarWinds Serv-U IDOR privilege escalation to root](https://junglewise.ai/threats/cve-2026-28316-solarwinds-serv-u-idor-privilege-escalation-to-root)
- [SolarWinds Serv-U stored XSS in administrator interface](https://junglewise.ai/threats/cve-2026-28315-solarwinds-serv-u-stored-xss-in-administrator-interface)
- [SolarWinds Serv-U account takeover via IDOR](https://junglewise.ai/threats/cve-2026-28314-solarwinds-serv-u-account-takeover-via-idor)