en
Severity across 28 analyzed records
A short verification protects source data and prevents automated AI requests.
The GCVE catalog currently lists 55 vulnerability records affecting Serv-U.
Among the 28 records analyzed by CyStack, 23 are High or Critical and 1 appear in the CISA KEV catalog.
Compare the version you run with each vulnerability and the provider guidance below. The data only includes records analyzed so far.
| CVE | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-28321SolarWinds Serv-U Broken Access Control Vulnerability | Exploitation statusNot known exploited | FixYes | Published07/21/2026 | SeverityCritical |
CVE-2026-28317SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability | Exploitation statusNot known exploited | FixYes | Published07/21/2026 | SeverityCritical |
CVE-2026-28316SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability | Exploitation statusNot known exploited | FixYes | Published07/21/2026 | SeverityCritical |
CVE-2026-28315SolarWinds Serv-U Authenticated Stored Cross-site Scripting (XSS) Vulnerability | Exploitation statusNot known exploited | FixYes | Published07/21/2026 | SeverityMedium |
CVE-2026-28314SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability | Exploitation statusNot known exploited | FixYes | Published07/21/2026 | SeverityCritical |
CVE-2026-28313SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability | Exploitation statusNot known exploited | FixYes | Published07/21/2026 | SeverityCritical |
CVE-2026-28312SolarWinds Serv-U Privilege Escalation Vulnerability | Exploitation statusNot known exploited | FixYes | Published07/21/2026 | SeverityCritical |
CVE-2026-28310SolarWinds Serv-U Privilege Escalation Vulnerability | Exploitation statusNot known exploited | FixYes | Published07/21/2026 | SeverityCritical |
CVE-2026-28309SolarWinds Serv-U Broken Access Control Vulnerability | Exploitation statusNot known exploited | FixYes | Published07/21/2026 | SeverityCritical |
CVE-2026-28308SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability | Exploitation statusNot known exploited | FixYes | Published07/21/2026 | SeverityCritical |
CVE-2026-28307SolarWinds Serv-U Privilege Escalation Vulnerability | Exploitation statusNot known exploited | FixYes | Published07/21/2026 | SeverityCritical |
CVE-2026-28306SolarWinds Serv-U Privilege Escalation Vulnerability | Exploitation statusNot known exploited | FixYes | Published07/21/2026 | SeverityCritical |
CVE-2026-28305SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability | Exploitation statusNot known exploited | FixYes | Published07/21/2026 | SeverityCritical |
CVE-2026-28304SolarWinds Serv-U Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixYes | Published07/21/2026 | SeverityCritical |
CVE-2026-28302SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability | Exploitation statusNot known exploited | FixYes | Published07/21/2026 | SeverityCritical |
CVE-2026-28318SolarWinds Serv-U Unauthenticated Denial of Service Vulnerability | Exploitation statusKEV | FixYes | Published06/04/2026 | SeverityHigh |
CVE-2025-40541SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixYes | Published02/24/2026 | SeverityCritical |
CVE-2025-40540SolarWinds Serv-U Type Confusion Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixYes | Published02/24/2026 | SeverityCritical |
CVE-2025-40539SolarWinds Serv-U Type Confusion Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixYes | Published02/24/2026 | SeverityCritical |
CVE-2025-40538SolarWinds Serv-U Broken Access Control Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixYes | Published02/24/2026 | SeverityCritical |
CVE-2025-40549SolarWinds Serv-U Path Restriction Bypass Vulnerability | Exploitation statusNot known exploited | FixYes | Published11/18/2025 | SeverityCritical |
CVE-2025-40548SolarWinds Serv-U Broken Access Control - Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixYes | Published11/18/2025 | SeverityCritical |
CVE-2025-40547SolarWinds Serv-U Logic Abuse - Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixYes | Published11/18/2025 | SeverityCritical |
CVE-2024-45712SolarWinds Serv-U Client-Side Cross-Site Scripting Vulnerability | Exploitation statusNot known exploited | FixYes | Published04/15/2025 | SeverityLow |
CVE-2024-45711SolarWinds Serv-U FTP Service Directory Traversal Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixYes | Published10/16/2024 | SeverityHigh |
CVE-2024-45714SolarWinds Serv-U Stored XSS Vulnerability | Exploitation statusNot known exploited | FixYes | Published10/16/2024 | SeverityMedium |
CVE-2024-28995SolarWinds Serv-U L Directory Transversal Vulnerability | Exploitation statusKEV | FixYes | Published06/06/2024 | SeverityHigh |
CVE-2024-28072Arbitrary File Overwrite Vulnerability | Exploitation statusNot known exploited | FixYes | Published05/03/2024 | SeverityMedium |
CVE-2024-28073SolarWinds Serv-U Directory Traversal Remote Code Execution Vulnerability | Exploitation statusNot known exploited | FixNot confirmed | Published04/17/2024 | SeverityHigh |
CVE-2023-40053HTML injection Vulnerability in Serv-U 15.4 | Exploitation statusNot confirmed | FixYes | Published12/06/2023 | SeverityMedium |
CVE-2023-400602FA/MFA Bypass Vulnerability in Serv-U 15.4 and 15.4 Hotfix 1 | Exploitation statusNot known exploited | FixYes | Published09/07/2023 | SeverityHigh |
CVE-2023-351792FA/MFA Bypass Vulnerability in Serv-U 15.4 | Exploitation statusNot known exploited | FixYes | Published08/10/2023 | SeverityHigh |
CVE-2023-23841SolarWinds Serv-U Exposure of Sensitive Information Vulnerability | Exploitation statusNot known exploited | FixYes | Published06/15/2023 | SeverityHigh |
CVE-2022-38106Cross-Site Scripting Vulnerability in Serv-U Web Client | Exploitation statusNot known exploited | FixYes | Published12/16/2022 | SeverityMedium |
CVE-2021-35252Common Key Vulnerability in Serv-U FTP Server | Exploitation statusNot known exploited | FixYes | Published12/16/2022 | SeverityHigh |
CVE-2021-35249Domain Admin Broken Access Control | Exploitation statusNot confirmed | FixYes | Published05/17/2022 | SeverityMedium |
CVE-2021-35250Directory Transversal Vulnerability in Serv-U 15.3 | Exploitation statusNot confirmed | FixYes | Published04/25/2022 | SeverityHigh |
CVE-2021-35247Improper Input Validation Vulnerability in Serv-U | Exploitation statusKEV | FixYes | Published01/07/2022 | SeverityMedium |
CVE-2021-35242A valid CSRF token is present in response to an invalid request | Exploitation statusNot confirmed | FixYes | Published12/06/2021 | SeverityHigh |
CVE-2021-35245Broken Access Control Vulnerability for SolarWinds Serv-U | Exploitation statusNot confirmed | FixYes | Published12/06/2021 | SeverityHigh |
CVE-2021-35223Execute Command Function Allows Remote Code Execution (RCE)Vulnerability | Exploitation statusNot confirmed | FixYes | Published08/31/2021 | SeverityHigh |
CVE-2021-35211Serv-U Remote Memory Escape Vulnerability | Exploitation statusKEV | FixYes | Published07/14/2021 | SeverityCritical |
CVE-2021-32604CVE-2021-32604 | Exploitation statusNot confirmed | FixNot confirmed | Published05/11/2021 | SeverityUnknown |
CVE-2021-3154CVE-2021-3154 | Exploitation statusNot confirmed | FixNot confirmed | Published05/04/2021 | SeverityUnknown |
CVE-2021-25276CVE-2021-25276 | Exploitation statusNot confirmed | FixNot confirmed | Published02/03/2021 | SeverityUnknown |
CVE-2020-28001CVE-2020-28001 | Exploitation statusNot confirmed | FixNot confirmed | Published02/03/2021 | SeverityUnknown |
CVE-2020-27994CVE-2020-27994 | Exploitation statusNot confirmed | FixNot confirmed | Published02/03/2021 | SeverityUnknown |
CVE-2020-35482CVE-2020-35482 | Exploitation statusNot confirmed | FixNot confirmed | Published02/03/2021 | SeverityUnknown |
CVE-2020-35481CVE-2020-35481 | Exploitation statusNot confirmed | FixNot confirmed | Published02/03/2021 | SeverityUnknown |
CVE-2020-15573CVE-2020-15573 | Exploitation statusNot confirmed | FixNot confirmed | Published07/07/2020 | SeverityUnknown |
CVE-2020-15574CVE-2020-15574 | Exploitation statusNot confirmed | FixNot confirmed | Published07/07/2020 | SeverityUnknown |
CVE-2020-15575CVE-2020-15575 | Exploitation statusNot confirmed | FixNot confirmed | Published07/07/2020 | SeverityUnknown |
CVE-2020-15576CVE-2020-15576 | Exploitation statusNot confirmed | FixNot confirmed | Published07/07/2020 | SeverityUnknown |
CVE-2018-10240CVE-2018-10240 | Exploitation statusNot confirmed | FixNot confirmed | Published05/16/2018 | SeverityUnknown |
CVE-2018-10241CVE-2018-10241 | Exploitation statusNot confirmed | FixNot confirmed | Published05/16/2018 | SeverityUnknown |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
