CVE-2021-35247: SolarWinds Serv-U web login LDAP input validation flaw

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

medium priorityThe CVSS score is 5.3 with only low integrity impact, but the CVE is in CISA KEV, so it warrants prompt patching despite limited technical severity.

What it is

The Serv-U web login screen passed characters to LDAP authentication without sufficient sanitization. SolarWinds updated the input mechanism to add validation and sanitization, and states no downstream impact was detected because LDAP servers ignored the improper characters. The flaw is an improper input validation issue in the authentication path.

Impact

The CVSS vector shows only low integrity impact with no confidentiality or availability impact, so the practical attacker gain is limited to manipulating input handling rather than reading data or causing denial of service. SolarWinds reports no observed downstream effect.

Attack surface

Reachable over the network through the Serv-U web login screen that forwards credentials to LDAP; the vector indicates no privileges and no user interaction are required. The description does not specify which Serv-U versions are affected.

Exploitation

CVE-2021-35247 is listed in CISA KEV with a 2022-01-21 addition date, indicating known exploitation, while EPSS is low at roughly 3.5 percent for 30 days. No ransomware campaign use is recorded and no public exploit reference is included in the record.

What to do

• Update Serv-U to the latest version per the vendor release notes, which document the added input validation and sanitization.
• If immediate patching is not possible, restrict network access to the Serv-U web login interface to trusted management networks.
• Review LDAP authentication logs for malformed or unexpected characters submitted through the Serv-U login screen.
• Confirm LDAP server-side input handling and logging so improper characters are rejected and recorded.
• Track the CISA KEV due date and verify remediation status for all exposed Serv-U instances.

Detection

• Monitor Serv-U web login requests for unusual or non-conforming characters in username or credential fields.
• Alert on repeated authentication attempts containing special characters or encoding patterns against the Serv-U login endpoint.
• Correlate Serv-U authentication events with LDAP server logs for rejected or malformed bind attempts.
• Inventory internet-facing Serv-U deployments and verify version levels against the fixed release.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.