CVE-2021-35247

Improper Input Validation Vulnerability in Serv-U

4.3 MediumIn KEV

Serv-U web login screen to LDAP authentication was allowing characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization. Please Note: No downstream affect has been detected as the LDAP servers ignored improper characters. To insure proper input validation is completed in all environments. SolarWinds recommends scheduling an update to the latest version of Serv-U.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: None

Exploit likelihood

3.64%Up 3.2 points since Jan 8, 2022

What each source reports

CVE List Score used 4.3

Improper Input Validation Vulnerability in Serv-U

Record: CVE-2021-35247
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weakness: CWE-20
Updated: 2026-11-02

EUVDEUVD-2021-21890 4.3

Record: EUVD-2021-21890
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-jqwj-9jvg-583v 5.3

Serv-U web login screen was allowing characters that were not sanitized by the authentication...

Serv-U web login screen was allowing characters that were not sanitized by the authentication mechanism. SolarWinds has updated the authentication mechanism to remedy this issue and prevent unauthorized parameters to be used in the Serv-U login screen With the Log4j issue in the wild, input fields across the internet have been tested for vulnerability. Although Serv-U was not affected by the log4j issue, It was discovered that better input validation could be implemented.

Record: GHSA-jqwj-9jvg-583v
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-20
Updated: 2026-11-02

CISA KEV No score

SolarWinds Serv-U Improper Input Validation Vulnerability

SolarWinds Serv-U versions 15.2.5 and earlier contain an improper input validation vulnerability that allows attackers to build and send queries without sanitization.

Record: CVE-2021-35247
Weakness: CWE-20
Updated: 2026-11-02

NVD 4.3

Record: CVE-2021-35247
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Weakness: CWE-20
Updated: 2026-11-02

Affected products

solarwinds serv-u

History

History
Recorded	Changed	Sources
Nov 3, 2026	exploitation
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, CISA KEV, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-35247 is a medium vulnerability (CVSS 4.3) in Solarwinds Serv-u, published January 7, 2022. CISA lists it as known to be exploited, since January 21, 2022. EUVD reports exploitation since January 21, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.64%, the 89th percentile. No source names a fixed version.