Unrated severityCISA KEVNVD Advisory· Published Jan 7, 2022· Updated Oct 21, 2025

Improper Input Validation Vulnerability in Serv-U

CVE-2021-35247

Description

Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization. Please Note: No downstream affect has been detected as the LDAP servers ignored improper characters. To insure proper input validation is completed in all environments. SolarWinds recommends scheduling an update to the latest version of Serv-U.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Rhinosoft/Serv Ullm-fuzzy
SolarWinds/Serv-U MFTcpe-rescue
Range: 15.2.5 and previous versions

Patches

Vulnerability mechanics

References

documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-3_release_notes.htmmitrex_refsource_MISC
www.solarwinds.com/trust-center/security-advisories/cve-2021-35247mitrex_refsource_MISC

News mentions

CISA: Patch actively exploited SolarWinds Serv-U DoS vulnerability (CVE-2026-28318)
Help Net Security · Jun 8, 2026

cvss	0.000
epss	0.003
exploit	0.000
kev	0.120
patch	0.000
ransomware	0.000