# SolarWinds Serv-U vulnerabilities Source: https://junglewise.ai/threats/technologies/serv-u Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/serv-u.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 23 vulnerabilities in SolarWinds Serv-U: 0 in the last 7 days and 0 in the last 90 days, 21 of them critical and 4 exploited in the wild. The most recent, CVE-2026-28321, was published on 21 July 2026. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 0 - All time: 23 (21 critical, 4 exploited in the wild) ## About SolarWinds Serv-U Serv-U is a file transfer protocol server for secure file transfer and remote access. ## Latest SolarWinds Serv-U vulnerabilities - [CVE-2026-28321: SolarWinds Serv-U broken access control privilege escalation](https://junglewise.ai/threats/cve-2026-28321-solarwinds-serv-u-broken-access-control-privilege-escalation) (critical, CVSS 9.1, published 21 Jul 2026) - [CVE-2026-28317: SolarWinds Serv-U privilege escalation via IDOR](https://junglewise.ai/threats/cve-2026-28317-solarwinds-serv-u-privilege-escalation-via-idor) (critical, CVSS 9.1, published 21 Jul 2026) - [CVE-2026-28316: SolarWinds Serv-U IDOR privilege escalation to root](https://junglewise.ai/threats/cve-2026-28316-solarwinds-serv-u-idor-privilege-escalation-to-root) (critical, CVSS 9.1, published 21 Jul 2026) - [CVE-2026-28315: SolarWinds Serv-U stored XSS in administrator interface](https://junglewise.ai/threats/cve-2026-28315-solarwinds-serv-u-stored-xss-in-administrator-interface) (medium, CVSS 6.2, published 21 Jul 2026) - [CVE-2026-28314: SolarWinds Serv-U account takeover via IDOR](https://junglewise.ai/threats/cve-2026-28314-solarwinds-serv-u-account-takeover-via-idor) (critical, CVSS 9.1, published 21 Jul 2026) - [CVE-2026-28313: SolarWinds Serv-U IDOR and SMTP Hijacking](https://junglewise.ai/threats/cve-2026-28313-solarwinds-serv-u-idor-and-smtp-hijacking) (critical, CVSS 9.1, published 21 Jul 2026) - [CVE-2026-28312: SolarWinds Serv-U privilege escalation in administrator group access](https://junglewise.ai/threats/cve-2026-28312-solarwinds-serv-u-privilege-escalation-in-administrator-group) (critical, CVSS 9.1, published 21 Jul 2026) - [CVE-2026-28310: SolarWinds Serv-U privilege escalation in administrative interface](https://junglewise.ai/threats/cve-2026-28310-solarwinds-serv-u-privilege-escalation-in-administrative) (critical, CVSS 9.1, published 21 Jul 2026) - [CVE-2026-28309: SolarWinds Serv-U broken access control in administrator account creation](https://junglewise.ai/threats/cve-2026-28309-solarwinds-serv-u-broken-access-control-in-administrator-account) (critical, CVSS 9.1, published 21 Jul 2026) - [CVE-2026-28308: SolarWinds Serv-U IDOR remote code execution](https://junglewise.ai/threats/cve-2026-28308-solarwinds-serv-u-idor-remote-code-execution) (critical, CVSS 9.1, published 21 Jul 2026) - [CVE-2026-28307: SolarWinds Serv-U privilege escalation in domain user groups](https://junglewise.ai/threats/cve-2026-28307-solarwinds-serv-u-privilege-escalation-in-domain-user-groups) (critical, CVSS 9.1, published 21 Jul 2026) - [CVE-2026-28306: SolarWinds Serv-U privilege escalation in domain administration](https://junglewise.ai/threats/cve-2026-28306-solarwinds-serv-u-privilege-escalation-in-domain-administration) (critical, CVSS 9.1, published 21 Jul 2026) - [CVE-2026-28305: SolarWinds Serv-U IDOR remote code execution as root](https://junglewise.ai/threats/cve-2026-28305-solarwinds-serv-u-idor-remote-code-execution-as-root) (critical, CVSS 9.1, published 21 Jul 2026) - [CVE-2026-28304: SolarWinds Serv-U remote code execution via improper access control](https://junglewise.ai/threats/cve-2026-28304-solarwinds-serv-u-remote-code-execution-via-improper-access) (critical, CVSS 9.1, published 21 Jul 2026) - [CVE-2026-28302: SolarWinds Serv-U IDOR privilege escalation in group management](https://junglewise.ai/threats/cve-2026-28302-solarwinds-serv-u-idor-privilege-escalation-in-group-management) (critical, CVSS 9.1, published 21 Jul 2026) - [CVE-2026-28318: SolarWinds Serv-U denial of service via crafted POST request](https://junglewise.ai/threats/cve-2026-28318-solarwinds-serv-u-denial-of-service-via-crafted-post-request) (critical, exploited in the wild, CVSS 7.5, published 4 Jun 2026) - [CVE-2025-40549: A Path Restriction Bypass vulnerability exists in Serv-U that when abused, could give a malicious actor with access to…](https://junglewise.ai/threats/cve-2025-40549-a-path-restriction-bypass-vulnerability-exists-in-serv-u-that) (critical, CVSS 9.1, published 18 Nov 2025) - [CVE-2025-40548: A missing validation process exists in Serv U when abused, could give a malicious actor with access to admin…](https://junglewise.ai/threats/cve-2025-40548-a-missing-validation-process-exists-in-serv-u-when-abused-could) (critical, CVSS 9.1, published 18 Nov 2025) - [CVE-2025-40547: A logic error vulnerability exists in Serv-U which when abused could give a malicious actor with access to admin…](https://junglewise.ai/threats/cve-2025-40547-a-logic-error-vulnerability-exists-in-serv-u-which-when-abused) (critical, CVSS 9.1, published 18 Nov 2025) - [CVE-2024-28995: SolarWinds Serv-U Path Traversal Vulnerability](https://junglewise.ai/threats/cve-2024-28995-solarwinds-serv-u-path-traversal-vulnerability) (critical, exploited in the wild, CVSS 8.6, published 17 Jul 2024) - [CVE-2021-35247: SolarWinds Serv-U Improper Input Validation Vulnerability](https://junglewise.ai/threats/cve-2021-35247-solarwinds-serv-u-improper-input-validation-vulnerability) (critical, exploited in the wild, CVSS 5.3, published 21 Jan 2022) - [CVE-2021-35211: SolarWinds Serv-U Remote Code Execution Vulnerability](https://junglewise.ai/threats/cve-2021-35211-solarwinds-serv-u-remote-code-execution-vulnerability) (critical, exploited in the wild, CVSS 10, published 3 Nov 2021) - [CVE-1999-0219: Rhinosoft Serv-U buffer overflow in CWD and LS commands](https://junglewise.ai/threats/cve-1999-0219-rhinosoft-serv-u-buffer-overflow-in-cwd-and-ls-commands) (high, CVSS 7.8, published 1 Jul 1997) ## Most severe SolarWinds Serv-U vulnerabilities - [CVE-2021-35211: SolarWinds Serv-U Remote Code Execution Vulnerability](https://junglewise.ai/threats/cve-2021-35211-solarwinds-serv-u-remote-code-execution-vulnerability) (critical, exploited in the wild, CVSS 10, published 3 Nov 2021) - [CVE-2024-28995: SolarWinds Serv-U Path Traversal Vulnerability](https://junglewise.ai/threats/cve-2024-28995-solarwinds-serv-u-path-traversal-vulnerability) (critical, exploited in the wild, CVSS 8.6, published 17 Jul 2024) - [CVE-2026-28318: SolarWinds Serv-U denial of service via crafted POST request](https://junglewise.ai/threats/cve-2026-28318-solarwinds-serv-u-denial-of-service-via-crafted-post-request) (critical, exploited in the wild, CVSS 7.5, published 4 Jun 2026) - [CVE-2021-35247: SolarWinds Serv-U Improper Input Validation Vulnerability](https://junglewise.ai/threats/cve-2021-35247-solarwinds-serv-u-improper-input-validation-vulnerability) (critical, exploited in the wild, CVSS 5.3, published 21 Jan 2022) - [CVE-2025-40549: A Path Restriction Bypass vulnerability exists in Serv-U that when abused, could give a malicious actor with access to…](https://junglewise.ai/threats/cve-2025-40549-a-path-restriction-bypass-vulnerability-exists-in-serv-u-that) (critical, CVSS 9.1, published 18 Nov 2025) - [CVE-2025-40547: A logic error vulnerability exists in Serv-U which when abused could give a malicious actor with access to admin…](https://junglewise.ai/threats/cve-2025-40547-a-logic-error-vulnerability-exists-in-serv-u-which-when-abused) (critical, CVSS 9.1, published 18 Nov 2025) - [CVE-2025-40548: A missing validation process exists in Serv U when abused, could give a malicious actor with access to admin…](https://junglewise.ai/threats/cve-2025-40548-a-missing-validation-process-exists-in-serv-u-when-abused-could) (critical, CVSS 9.1, published 18 Nov 2025) - [CVE-2026-28321: SolarWinds Serv-U broken access control privilege escalation](https://junglewise.ai/threats/cve-2026-28321-solarwinds-serv-u-broken-access-control-privilege-escalation) (critical, CVSS 9.1, published 21 Jul 2026) - [CVE-2026-28317: SolarWinds Serv-U privilege escalation via IDOR](https://junglewise.ai/threats/cve-2026-28317-solarwinds-serv-u-privilege-escalation-via-idor) (critical, CVSS 9.1, published 21 Jul 2026) - [CVE-2026-28316: SolarWinds Serv-U IDOR privilege escalation to root](https://junglewise.ai/threats/cve-2026-28316-solarwinds-serv-u-idor-privilege-escalation-to-root) (critical, CVSS 9.1, published 21 Jul 2026) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other SolarWinds technologies - [SolarWinds Observability Self-Hosted](https://junglewise.ai/threats/technologies/observability-self-hosted): 9 vulnerabilities - [SolarWinds Web-Help-Desk](https://junglewise.ai/threats/technologies/web-help-desk): 7 vulnerabilities - [SolarWinds Dameware](https://junglewise.ai/threats/technologies/dameware): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "SolarWinds Serv-U vulnerabilities", https://junglewise.ai/threats/technologies/serv-u, 9 November 2026.