Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Serv-U — Vulnerabilities & Security Advisories 33

All 33 CVE vulnerabilities found in Serv-U, with AI-generated Chinese analysis, references, and POCs.

This page aggregates known vulnerabilities affecting Serv-U, a file transfer utility for Windows developed by SoftVista. The collection focuses on implementation-level flaws, including buffer overflows, improper input validation, and insufficient access control, spanning releases from 2016 through 2024. Readers can use this hub to track the vendor's security advisories, analyze the common weakness classes present in the software, and review the full history of disclosed vulnerabilities for this specific product to assess its long-term security posture.

Vendor: SolarWinds

CVE ID Title CVSS Severity Published
CVE-2026-28321 SolarWinds Serv-U Broken Access Control Vulnerability CWE-284 4.7 Medium 2026-07-21
CVE-2026-28317 SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability CWE-639 4.7 Medium 2026-07-21
CVE-2026-28316 SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability CWE-639 4.7 Medium 2026-07-21
CVE-2026-28315 SolarWinds Serv-U Authenticated Stored Cross-site Scripting (XSS) Vulnerability CWE-79 6.2 Medium 2026-07-21
CVE-2026-28314 SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability CWE-639 4.7 Medium 2026-07-21
CVE-2026-28313 SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability CWE-639 4.7 Medium 2026-07-21
CVE-2026-28312 SolarWinds Serv-U Privilege Escalation Vulnerability CWE-285 4.7 Medium 2026-07-21
CVE-2026-28310 SolarWinds Serv-U Privilege Escalation Vulnerability CWE-862 4.7 Medium 2026-07-21
CVE-2026-28309 SolarWinds Serv-U Broken Access Control Vulnerability CWE-862 4.7 Medium 2026-07-21
CVE-2026-28308 SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability CWE-639 4.7 Medium 2026-07-21
CVE-2026-28307 SolarWinds Serv-U Privilege Escalation Vulnerability CWE-284 4.7 Medium 2026-07-21
CVE-2026-28306 SolarWinds Serv-U Privilege Escalation Vulnerability CWE-284 4.7 Medium 2026-07-21
CVE-2026-28305 SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability CWE-639 4.7 Medium 2026-07-21
CVE-2026-28304 SolarWinds Serv-U Remote Code Execution Vulnerability CWE-284 4.7 Medium 2026-07-21
CVE-2026-28302 SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability CWE-639 4.7 Medium 2026-07-21
CVE-2026-28318 SolarWinds Serv-U Unauthenticated Denial of Service Vulnerability CWE-400 7.5 High 2026-06-04
CVE-2025-40541 SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Remote Code Execution Vulnerability CWE-704 9.1 Critical 2026-02-24
CVE-2025-40540 SolarWinds Serv-U Type Confusion Remote Code Execution Vulnerability CWE-704 9.1 Critical 2026-02-24
CVE-2025-40539 SolarWinds Serv-U Type Confusion Remote Code Execution Vulnerability CWE-704 9.1 Critical 2026-02-24
CVE-2025-40538 SolarWinds Serv-U Broken Access Control Remote Code Execution Vulnerability CWE-269 9.1 Critical 2026-02-24
CVE-2025-40549 SolarWinds Serv-U Path Restriction Bypass Vulnerability CWE-22 9.1 Critical 2025-11-18
CVE-2025-40548 SolarWinds Serv-U Broken Access Control - Remote Code Execution Vulnerability CWE-269 9.1 Critical 2025-11-18
CVE-2025-40547 SolarWinds Serv-U Logic Abuse - Remote Code Execution Vulnerability CWE-116 9.1 Critical 2025-11-18
CVE-2024-45712 SolarWinds Serv-U Client-Side Cross-Site Scripting Vulnerability CWE-79 2.6 Low 2025-04-15
CVE-2024-45711 SolarWinds Serv-U FTP Service Directory Traversal Remote Code Execution Vulnerability CWE-22 7.5 High 2024-10-16
CVE-2024-45714 SolarWinds Serv-U Stored XSS Vulnerability CWE-79 4.8 Medium 2024-10-16
CVE-2024-28072 Arbitrary File Overwrite Vulnerability CWE-532 5.7 Medium 2024-05-03
CVE-2023-40053 HTML injection Vulnerability in Serv-U 15.4 CWE-20 5.0 Medium 2023-12-06
CVE-2023-40060 2FA/MFA Bypass Vulnerability in Serv-U 15.4 and 15.4 Hotfix 1 CWE-284 7.2 High 2023-09-07
CVE-2021-35249 Domain Admin Broken Access Control CWE-284 4.3 Medium 2022-05-17

All 33 known CVE vulnerabilities affecting Serv-U with full Chinese analysis, references, and POCs where available.