CVE-2021-35211: SolarWinds Serv-U Remote Code Execution Vulnerability

CVE-2021-35211 is a remote code execution vulnerability in SolarWinds Serv-U. It stems from an unspecified memory escape weakness that can let an attacker run code on the affected system. Because Serv-U is commonly used for secure file transfer, successful exploitation can give an attacker a foothold on a host that often holds sensitive data or sits at a network boundary. Public reporting also associates this vulnerability with known ransomware use, so organizations running Serv-U should treat it as a priority.

Details such as exact affected builds, attack prerequisites, and scoring must be confirmed against the vendor advisory. The CISA-required action is to apply updates per vendor instructions.

How it works

The weakness is classified as CWE-787 (out-of-bounds write). In general terms for this class, the software writes data past the bounds of an intended memory buffer. That corruption can alter control flow or other critical structures, which an attacker may abuse to achieve remote code execution.

CISA describes the issue in Serv-U as an unspecified memory escape vulnerability that can allow remote code execution. Public detail on the precise trigger, protocol path, or required access level is limited; defenders should not assume a particular exploit sequence and should rely on the vendor advisory for authoritative mechanics. In practice, flaws of this type in file-transfer products are often reachable over the network services the product exposes, so exposure of those services increases risk.

Am I affected? How to find it in your systems

SolarWinds Serv-U is file-transfer / FTP-style server software. It typically runs on Windows or Linux hosts that provide managed file transfer, often in DMZs or other perimeter segments, and may be integrated with authentication directories or storage backends.

• Inventory: Search asset and software inventories, package managers, and install directories for Serv-U. Check configuration management databases, vulnerability scanners, and license or support portals tied to SolarWinds products.
• Version and configuration: Identify installed Serv-U versions and compare them to the fixed releases listed in the vendor advisory. Note which listeners, protocols, and interfaces are enabled and whether the service is reachable from untrusted networks.
• Telemetry: Review authentication and session logs, process-creation events on the Serv-U host, unexpected child processes of the Serv-U service, and outbound connections from that host that do not match normal file-transfer patterns. Correlate with IDS/IPS or WAF alerts for anomalous traffic to Serv-U ports. Confirm any detection signatures or indicators against current vendor and CISA guidance rather than assuming a fixed set of IOCs.

How to remediate

Patch first. Apply the updates SolarWinds provides for this vulnerability, following the vendor’s installation and restart guidance. CISA’s required action is to apply updates per vendor instructions; verify the specific packages and any post-update checks in the official advisory.

• After patching, confirm the running version matches a fixed release and that the service starts cleanly.
• For this weakness class, reduce unnecessary attack surface: disable unused protocols and listeners, restrict administrative interfaces, and run the service with least privilege.
• Ensure hosts are covered by endpoint detection, central logging, and regular vulnerability scanning so regressions or missed instances are caught.

If you can't patch immediately

Compensating controls cannot fully replace the vendor fix but can lower likelihood and impact until you can patch.

• Segmentation: Place Serv-U hosts in tightly controlled network segments; allow only required source IPs and ports to reach the service, and block direct internet exposure where business needs allow.
• Virtual patching / WAF: If you have a web application firewall or reverse proxy in front of any HTTP(S)-facing Serv-U components, apply vendor- or community-supplied rules that target known abuse patterns for this class—only after validating they do not break legitimate traffic. Confirm rule applicability against the advisory.
• Feature reduction: Disable nonessential Serv-U features, protocols, or anonymous/unauthenticated access paths until patched.
• Monitoring: Increase logging verbosity for the service, alert on process anomalies and unusual outbound traffic from the host, and ensure security teams can investigate quickly. Treat any confirmed exploitation attempt as an incident.

If your data may have been exposed

Actively exploited vulnerabilities, including those with known ransomware use, can lead to unauthorized access, data theft, or encryption of systems. If you have reason to believe Serv-U was compromised, follow your incident-response process: isolate affected hosts, preserve logs and disk images, rotate credentials that may have been present on the system, and assess what data the service could access. You can also run a free exposure scan of your email addresses against known breach datasets to see whether associated accounts appear in public breach collections, then prioritize password resets and monitoring for those identities.