CVE-2024-28995—SolarWinds Serv-U Path Traversal Vulnerability

Vulnerability Name

SolarWinds Serv-U Path Traversal Vulnerability

Description

SolarWinds Serv-U contains a path traversal vulnerability that allows an attacker access to read sensitive files on the host machine.

Known To Be Used in Ransomware Campaigns?

Ransomware Status:

Unknown

Action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Additional Notes

• https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28995
• https://nvd.nist.gov/vuln/detail/CVE-2024-28995

Related News Articles

• CISA: Patch actively exploited SolarWinds Serv-U DoS vulnerability (CVE-2026-28318)June 8, 2026
• CISA: Hackers now exploit SolarWinds Serv-U flaw to crash serversJune 5, 2026
• SolarWinds Patches 4 Critical Serv-U 15.5 Flaws Allowing Root Code ExecutionFebruary 25, 2026
• Critical SolarWinds Serv-U flaws offer root access to serversFebruary 24, 2026
• SolarWinds Patches 8 Critical Flaws in Access Rights Manager SoftwareJuly 19, 2024

Related Weaknesses

• CWE-22