Secuno
ENNL
Book demo

CVE-2021-35247

SolarWinds Serv-U Improper Input Validation

4.3 MEDIUMActively exploited (CISA KEV)EPSS 3.45%
  1. Published10 Jan 2022
  2. Added to CISA KEV21 Jan 2022
  3. Remediation due4 Feb 2022
Actively exploited (CISA KEV)

SolarWinds Serv-U versions 15.2.5 and earlier contain an improper input validation vulnerability that allows attackers to build and send queries without sanitization.

Added to KEV: 21 Jan 2022Federal remediation due: 4 Feb 2022

Description

Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization. Please Note: No downstream affect has been detected as the LDAP servers ignored improper characters. To insure proper input validation is completed in all environments. SolarWinds recommends scheduling an update to the latest version of Serv-U.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionRequired
ScopeUnchanged
ConfidentialityNone
IntegrityLow
AvailabilityNone
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Affected products

SolarWinds Serv-u< 15.3

Remediation

Fixed in
SolarWinds Serv-u≥ 15.3

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-843178.8
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1,…
CVE-2026-843168.8
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1,…
CVE-2026-571438.8
PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.62,…
CVE-2026-1034138.8
Improper input validation vulnerability in Apache Camel Karavan. When a deployment…
CVE-2026-764688.2
As part of Cisco's ongoing commitment to proactive security and product quality, the…
CVE-2026-764568.6
As part of Cisco's ongoing commitment to proactive security and product quality, the…

Frequently asked

Is CVE-2021-35247 being actively exploited?

Yes. CVE-2021-35247 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 21 Jan 2022.

How severe is CVE-2021-35247?

CVE-2021-35247 has a CVSS 3.1 base score of 4.3, rated medium. EPSS estimates a 3.45% probability of exploitation.

Which products are affected by CVE-2021-35247?

Affected products include SolarWinds Serv-u.

How do I fix CVE-2021-35247?

Upgrade affected software to a fixed version, for example SolarWinds Serv-u 15.3 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2021-35247 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, a risk for it never ranks below high, and the update that fixes it moves to the Emergency patch lane. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.