CVE-2021-35247

SolarWinds Serv-U versions 15.2.5 and earlier suffer from improper input validation allowing attackers to send unsanitized queries.

This improper input validation flaw enables attackers to execute arbitrary commands without sanitization, posing a severe risk to DIB organizations relying on SolarWinds for network monitoring. The vulnerability is actively exploited in the wild, indicating a high probability of compromise and data exfiltration. DIBs must immediately patch to Serv-U 15.2.6 or later and audit their supply chain for unpatched instances.

Shame score — A known, actively exploited vulnerability in a critical network monitoring tool used by DIBs, demonstrating severe negligence in patch management and supply chain security.