# Serv-U vulnerabilities > Serv-U is made by Solarwinds. We track 31 published vulnerabilities listed under that exact name, across 21 versions. 4 of them are on the list of flaws known to be exploited, the newest added on 5 June 2026. Solarwinds lists newer releases under their own names, such as Serv-U File Server, so check those pages too. Canonical page: https://www.edgeprotect.io/product/solarwinds/serv-u ## At a glance - **Made by:** [Solarwinds](https://www.edgeprotect.io/vendors/solarwinds) - **Published vulnerabilities:** 31 - **Known to be exploited:** 4 (listed under the name Serv-U) - **Versions tracked:** 21 - **Most recently added to the known-exploited list:** [CVE-2026-28318](https://www.edgeprotect.io/what-is/cve-2026-28318), 5 June 2026. We keep watching the list. ## Is Serv-U listed under other names? Solarwinds also lists Serv-U under more specific names, such as Serv-U File Server and Serv-U FTP Server. Flaws listed only under those names are counted on their own pages, not here. - [Serv-U File Server](https://www.edgeprotect.io/product/solarwinds/serv-u_file_server): 20 published vulnerabilities - [Serv-U FTP Server](https://www.edgeprotect.io/product/solarwinds/serv-u_ftp_server): 11 published vulnerabilities - [Serv-U Mft Server](https://www.edgeprotect.io/product/solarwinds/serv-u_mft_server): 2 published vulnerabilities - [Serv-U Managed File Transfer](https://www.edgeprotect.io/product/solarwinds/serv-u_managed_file_transfer): 1 published vulnerability ## Which versions of Serv-U do the exploited flaws hit? Each exploited flaw lists the versions it affects, as published. "before 15.5.4" means every version up to, but not including, 15.5.4. - [CVE-2026-28318](https://www.edgeprotect.io/what-is/cve-2026-28318) (SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability): before 15.5.4, 15.5.4 - [CVE-2024-28995](https://www.edgeprotect.io/what-is/cve-2024-28995) (SolarWinds Serv-U Path Traversal Vulnerability): before 15.4.2, 15.4.2, 15.4.2-hotfix1 - [CVE-2021-35247](https://www.edgeprotect.io/what-is/cve-2021-35247) (SolarWinds Serv-U Improper Input Validation Vulnerability): before 15.3 - [CVE-2021-35211](https://www.edgeprotect.io/what-is/cve-2021-35211) (SolarWinds Serv-U Remote Code Execution Vulnerability): before 15.2.3, 15.2.3, 15.2.3-hotfix1 ## Which Serv-U vulnerabilities are being exploited? 4 flaws are on the government list of vulnerabilities known to be exploited, newest first: - [CVE-2026-28318](https://www.edgeprotect.io/what-is/cve-2026-28318): SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability. High, CVSS 7.5, chance of use in 30 days 44%, known exploited since 5 June 2026. - [CVE-2024-28995](https://www.edgeprotect.io/what-is/cve-2024-28995): SolarWinds Serv-U Path Traversal Vulnerability. High, CVSS 8.6, chance of use in 30 days >99%, known exploited since 17 July 2024. - [CVE-2021-35247](https://www.edgeprotect.io/what-is/cve-2021-35247): SolarWinds Serv-U Improper Input Validation Vulnerability. Medium, CVSS 4.3, chance of use in 30 days 3.5%, known exploited since 21 January 2022. - [CVE-2021-35211](https://www.edgeprotect.io/what-is/cve-2021-35211): SolarWinds Serv-U Remote Code Execution Vulnerability. Critical, CVSS 9.0, chance of use in 30 days 91%, known exploited since 3 November 2021. ## Which Serv-U flaws are most likely to be used? Ranked by the latest exploit-likelihood forecast (the chance each flaw is used in an attack in the next 30 days): - [CVE-2024-28995](https://www.edgeprotect.io/what-is/cve-2024-28995): >99%, High (CVSS 8.6), known exploited - [CVE-2021-35211](https://www.edgeprotect.io/what-is/cve-2021-35211): 91%, Critical (CVSS 9.0), known exploited - [CVE-2026-28318](https://www.edgeprotect.io/what-is/cve-2026-28318): 44%, High (CVSS 7.5), known exploited - [CVE-2021-35250](https://www.edgeprotect.io/what-is/cve-2021-35250): 13%, High (CVSS 7.5) - [CVE-2024-45711](https://www.edgeprotect.io/what-is/cve-2024-45711): 6.3%, High (CVSS 8.8) - [CVE-2020-27994](https://www.edgeprotect.io/what-is/cve-2020-27994): 4.0%, Medium (CVSS 6.5) - [CVE-2020-28001](https://www.edgeprotect.io/what-is/cve-2020-28001): 3.8%, Medium (CVSS 5.4) - [CVE-2021-35247](https://www.edgeprotect.io/what-is/cve-2021-35247): 3.5%, Medium (CVSS 4.3), known exploited - [CVE-2021-35223](https://www.edgeprotect.io/what-is/cve-2021-35223): 2.9%, High (CVSS 8.8) - [CVE-2021-32604](https://www.edgeprotect.io/what-is/cve-2021-32604): 1.7%, Medium (CVSS 5.4) ## Questions ### How many vulnerabilities does Serv-U have? We track 31 published vulnerabilities listed under the name Serv-U, across 21 versions. The most recent Serv-U flaw added to the known-exploited list is CVE-2026-28318, on 5 June 2026. ### Which Serv-U vulnerabilities are being exploited? 4 are on the list of flaws known to be exploited. The most recently added are CVE-2026-28318, CVE-2024-28995 and CVE-2021-35247. ### Why are newer Serv-U flaws missing from this page? Solarwinds also lists Serv-U under more specific names, such as Serv-U File Server and Serv-U FTP Server. Flaws listed only under those names are counted on their own pages, not here. Open the release you run to see its own list. ### Which versions of Serv-U do the exploited flaws affect? Each flaw names its own versions, usually as ranges. The newest, CVE-2026-28318, affects before 15.5.4, 15.5.4. The versions for every exploited flaw are listed on this page. ### How do I get alerts for Serv-U? Create a EdgeProtect account and track Serv-U. We match it against every published flaw, give each one a risk score from 0 to 100 and keep watching, so you hear about new ones as soon as we know, by email, in the app or by webhook. ## Running Serv-U? EdgeProtect keeps checking for you: - **Tell us what you run.** Pick your software from a list, or let us work it out from your website. - **We match it to every flaw.** Over 400,000 published flaws, checked against your list. - **Ranked by real-world risk.** Every flaw gets a 0 to 100 risk score, kept up to date, led by evidence criminals are using it. - **Told as soon as we know.** An alert by email, in the app or by webhook to your own tools. Start free (no card, nothing to install): https://www.edgeprotect.io/register Book a demo: https://www.edgeprotect.io/contact