CVE-2021-35247
Published 2022-01-10 · Updated 2026-06-17 · Source psirt@solarwinds.com
Summary
CVE-2021-35247 is a medium-severity (CVSS 4.3) vulnerability in SolarWinds Serv-U. CISA added it to the Known Exploited Vulnerabilities catalog on January 21, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by February 4, 2022. CISA does not currently list it as used in ransomware campaigns. SolarWinds has 11 vulnerabilities in the KEV catalog, 2 of them linked to ransomware.
All 11 known-exploited SolarWinds vulnerabilities →Description
Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization. Please Note: No downstream affect has been detected as the LDAP servers ignored improper characters. To insure proper input validation is completed in all environments. SolarWinds recommends scheduling an update to the latest version of Serv-U.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CISA Known-Exploited Vulnerability
Product: SolarWinds — Serv-U
Name: SolarWinds Serv-U Improper Input Validation Vulnerability
Date added: 2022-01-21 · Due: 2022-02-04
Required action: Apply updates per vendor instructions.
References
- https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-3_release_notes.htm
- https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35247
- https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-3_release_notes.htm
- https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35247
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-35247