Loading story…
SolarWinds disclosed CVE-2024-28995, a high-severity directory traversal and local file disclosure flaw in its Serv-U managed file transfer software that affects versions earlier than 15.4.2 Hotfix 2. The vulnerability can be exploited remotely and without authentication via crafted HTTP GET requests, allowing attackers to read arbitrary files from the host system, including sensitive material such as credentials, certificates, and configuration data. Rapid7 described the issue as trivially exploitable, and SolarWinds issued fixes through Serv-U 15.4.2 HF2, with deployment requiring 15.4.2 HF1 first.
Security researchers and national defenders reported that exploitation began quickly after disclosure. GreyNoise observed internet-wide exploitation activity targeting exposed Serv-U instances, while CSIRT.SK warned that public scanning tools and proof-of-concept exploit code were increasing the likelihood of opportunistic attacks. The combination of unauthenticated access, straightforward exploitation, and the ability to extract sensitive files has made patching exposed Serv-U servers an urgent priority.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
CSIRT.SK issued an alert that CVE-2024-28995 was being actively exploited and noted that public scanning tools and proof-of-concept exploit code increased the risk of opportunistic attacks. The advisory urged immediate upgrading to Serv-U 15.4.2 HF2.
GreyNoise reported seeing exploitation activity for CVE-2024-28995 against SolarWinds Serv-U in the wild, indicating attackers were actively targeting the vulnerability after disclosure.
Rapid7 published technical analysis describing CVE-2024-28995 in SolarWinds Serv-U as a trivially exploitable information disclosure flaw, highlighting the ease with which unauthenticated attackers could read arbitrary files.
SolarWinds published a security advisory and release notes for Serv-U 15.4.2 Hotfix 2 to address CVE-2024-28995, a directory traversal/local file disclosure vulnerability affecting versions earlier than 15.4.2 HF2.
5 references tracked. Mallory keeps watching after this page renders.
csirt.sk
Open sourcelabs.greynoise.io
Open sourcerapid7.com
Open sourcesolarwinds.com
Open sourcesupport.solarwinds.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SolarWinds disclosed and patched multiple high-severity vulnerabilities in **Serv-U** that can let authenticated attackers take over accounts, escalate privileges, read and write arbitrary files, and in some cases achieve remote code execution as `root`. The issues affect **Serv-U 15.5.4 HF1 and earlier** on both Windows and Linux, with SolarWinds noting the impact is generally more severe on Linux and lower on Windows. The vendor fixed the flaws in **Serv-U 2026.3** and said the vulnerabilities were reported through the **Intigriti** bug bounty program. The disclosed CVEs include broken access control, privilege escalation, and **IDOR** weaknesses such as **`CVE-2026-28321`** for arbitrary file read/write that can be leveraged into code execution, **`CVE-2026-28312`** and **`CVE-2026-28310`** for elevation to system administrator, **`CVE-2026-28309`** for creating system administrator accounts, and **`CVE-2026-28313`**, **`CVE-2026-28314`**, **`CVE-2026-28316`**, and **`CVE-2026-28317`** for account takeover, SMTP hijacking, and further privilege escalation. SolarWinds said the bugs require existing privileges rather than unauthenticated access, but warned that stolen or low-tier credentials could be chained to gain full control of a Serv-U host; no public exploits or confirmed in-the-wild abuse had been reported at disclosure.
Jul 22, 2026
SolarWinds Serv-U has been found to contain two critical vulnerabilities, CVE-2025-40548 and CVE-2025-40549, both with a CVSS score of 9.1. These flaws allow authenticated administrators to perform remote code execution and bypass path restrictions, potentially enabling attackers with admin access to execute arbitrary code or access restricted directories. The vulnerabilities are particularly severe on non-Windows deployments, where default service account privileges may not mitigate the risk. Both issues require administrative privileges to exploit, but their impact is considered critical due to the potential for full system compromise. Security advisories highlight that the vulnerabilities stem from missing validation processes and improper path restriction enforcement within the Serv-U software. While the flaws are not exploitable by unauthenticated users, organizations using SolarWinds Serv-U are urged to review their deployments, especially where admin credentials may be exposed or weakly protected. No specific affected product versions have been listed, but the vulnerabilities have been confirmed by SolarWinds and are publicly documented in multiple security feeds.
Jun 29, 2026
CISA warned that attackers are actively exploiting **SolarWinds Serv-U** vulnerability `CVE-2026-28318`, a recently patched high-severity denial-of-service flaw in the company's managed file transfer and FTP server software for **Windows and Linux**. The bug can be triggered through low-complexity, unauthenticated `POST` requests—reported to include the `Content-Encoding: deflate` header—causing the Serv-U service to crash through uncontrolled resource consumption. CISA has added the issue to its **Known Exploited Vulnerabilities** catalog and directed Federal Civilian Executive Branch agencies to remediate by **June 19** under Binding Operational Directive 22-01. SolarWinds said the flaw is fixed in **Serv-U 15.5.4 Hotfix 1**, while CISA urged private-sector organizations to apply mitigations immediately or discontinue use if mitigations are unavailable. Reporting also noted that thousands of Serv-U servers remain exposed online, expanding the potential attack surface. The warning comes amid a broader pattern of SolarWinds Serv-U exploitation, with earlier campaigns tied to the **Clop** ransomware gang, **DEV-0322** Chinese threat actors, and abuse of prior Serv-U vulnerabilities.
Jun 29, 2026