[ CVE-2021-35211 · Published 14 Jul 2021 ]
SolarWinds Serv-U Remote Code Execution Vulnerability
Exploited · CISA KEV CVSS 10.0
EPSS 91%Fix available
[ Why it matters ]Priority signals
- Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2021-11-03
- Known to be used in ransomware campaigns
- EPSS: 91% chance of exploitation in the next 30 days (higher than 100% of CVEs)
- Critical severity: CVSS 10.0
[ Description ]Official description
Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerability. If exploited, a threat actor may be able to gain privileged access to the machine hosting Serv-U Only. SolarWinds Serv-U Managed File Transfer and Serv-U Secure FTP for Windows before 15.2.3 HF2 are affected by this vulnerability.
CISA: SolarWinds Serv-U contains an unspecified memory escape vulnerability which can allow for remote code execution.
[ Fixes ]Fixes and patches
CISA required action (US federal deadline 17 Nov 2021): Apply updates per vendor instructions.
- Patch on microsoft.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
- Patch on solarwinds.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD
[ References ]References
- www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-s…PatchVendor Advisory
- www.solarwinds.com/trust-center/security-advisories/cve-2021-35211PatchVendor Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource