CVE-2024-28995
SolarWinds Serv-U L Directory Transversal Vulnerability
SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
SolarWinds Serv-U L Directory Transversal Vulnerability
SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine.
- Record
CVE-2024-28995- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2024-26057
SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine.
- Record
EUVD-2024-26057- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-gr87-q8xh-gq3c
SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow...
SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine.
- Record
GHSA-gr87-q8xh-gq3c- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
CISA KEV No score
SolarWinds Serv-U Path Traversal Vulnerability
SolarWinds Serv-U contains a path traversal vulnerability that allows an attacker access to read sensitive files on the host machine.
- Record
CVE-2024-28995- Weakness
- CWE-22
- Updated
- 2026-11-02
NVD
SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine.
- Record
CVE-2024-28995- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-22
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | 0xc4t/CVE-2024-28995 | 2024-06-14 |
| PoC in GitHub | bigb0x/CVE-2024-28995 | 2024-06-14 |
| PoC in GitHub | demoAlitalia/CVE-2024-28995 | 2024-06-14 |
| PoC in GitHub | ggfzx/CVE-2024-28995 | 2024-06-14 |
| PoC in GitHub | huseyinstif/CVE-2024-28995-Nuclei-Template | 2024-06-14 |
| PoC in GitHub | muhammetali20/CVE-2024-28995 | 2024-06-16 |
| PoC in GitHub | GraySignal/CVE-2024-28995-SolarWinds-Serv-U | 2024-06-26 |
| PoC in GitHub | Stuub/CVE-2024-28995 | 2024-07-01 |
| PoC in GitHub | gotr00t0day/CVE-2024-28995 | 2024-08-24 |
| Exploit-DB | SolarWinds Serv-U 15.4.2 HF1 - Directory Traversal | 2025-05-29 |
| Nuclei | SolarWinds Serv-U - Directory Traversal | |
| Metasploit | SolarWinds Serv-U Unauthenticated Arbitrary File Read |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-28995 is a high vulnerability (CVSS 8.6) in Solarwinds Serv-u, published June 6, 2024. CISA lists it as known to be exploited, since July 17, 2024. EUVD reports exploitation since July 17, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 99.6%, the 99th percentile. No source names a fixed version.