CVE-2024-28995
SolarWinds Serv-U
Published 6 Jun 2024 · updated 17 Jun 2026 · Analyzed
7.5 High · CVSS 3.1, NVD
Exploited in the wild
CISA added this to its Known Exploited Vulnerabilities catalog on 17 Jul 2024, with a remediation deadline of 7 Aug 2024 for US federal agencies.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Description
SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine.
References
- www.solarwinds.com/trust-center/security-advisories/CVE-2024-28995 · Vendor Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-28995 · US Government Resource