CVE-2024-28995
SolarWinds Serv-U: Path Traversal
As of , CVE-2024-28995 in SolarWinds Serv-U is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch this week.
- Exploited
- Yes: CISA listed it on 17 July 2024
- US federal deadline
- 7 August 202421 days after CISA listed it. US federal civilian agencies must fix it by then.
- Used in ransomware campaigns
- Not known to CISA
- EPSS score
- 0.99Higher than 99% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
- EPSS when listed
- 0.77 on 17 July 2024EPSS on the day CISA listed it.
- Public exploit
- 1 Metasploit module and 1 Exploit-DB entry
- Fix
- Vendor advice: www.solarwinds.comLinks below, from CISA's entry.
What CISA says to do
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA's required action
What the flaw is
SolarWinds Serv-U contains a path traversal vulnerability that allows an attacker access to read sensitive files on the host machine.
CISA's description
SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine.
The CVE record's description, from SolarWinds
- CVE published
- 6 June 2024
- Assigned by
- SolarWinds
- CVSS
- 8.6 High (CVSS 3.1, from the CNA)
- CWE-22
- Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- CISA SSVC, exploitation
- active
- CISA SSVC, automatable
- yes
- CISA SSVC, technical impact
- partial
Timeline
- The CVE record was published.
- CISA added it to its list of exploited vulnerabilities.
- The US federal deadline to fix it.
- Exploit-DB published an exploit (EDB-ID 52311).
Public exploits
Facts from Metasploit's module list and Exploit-DB's index; we never copy exploit code.
- Metasploit: SolarWinds Serv-U Unauthenticated Arbitrary File Readauxiliary module, rank normal
- Exploit-DB: SolarWinds Serv-U 15.4.2 HF1 - Directory TraversalEDB-ID 52311, 29 May 2025
Serv-U: other exploited entries
| Vulnerability | Product | Our group | Listed | Deadline | EPSS |
|---|---|---|---|---|---|
| CVE-2021-35211Remote Code Execution | SolarWinds Serv-U | Patch this weekRansomware use; EPSS 0.91 | 0.91 | ||
| CVE-2021-35247Improper Input Validation | SolarWinds Serv-U | Patch soon | 0.03 | ||
| CVE-2026-28318Uncontrolled Resource Consumption | SolarWinds Serv-U | Patch soon | 0.02 |
Read further
- CVE recordcve.org
- NVD entrynvd.nist.gov
- CISA's catalogcisa.gov
- EPSS for this CVEapi.first.org