high8.6Known exploitedPublic exploit code
CVE-2024-28995
SolarWinds Serv-U Path Traversal Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2024-07-17. Federal due date: 2024-08-07.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- SolarWinds Serv-U 15.4.2 HF1 - Directory Traversal2025-05-29 · remote · multiple
Impact
SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Solarwinds | Serv-U | before 15.4.2 Version 15.4.2 |