CVE-2024-28995: SolarWinds Serv-U path traversal allows arbitrary file read

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with active exploitation, has a near-maximum EPSS score, and allows unauthenticated remote reading of sensitive files.

What it is

SolarWinds Serv-U contains a path traversal flaw (CWE-22) that lets an unauthenticated remote attacker read sensitive files from the host. The vulnerability is remotely reachable with no privileges or user interaction, and it is listed in CISA KEV, so it is actively exploited in the wild.

Impact

An attacker can read arbitrary files on the host, exposing credentials, configuration and other sensitive data. This is a confidentiality-only impact; there is no evidence in the record of code execution or data modification.

Attack surface

Reachable over the network via the Serv-U service (CVSS AV:N, PR:N, UI:N), so no authentication or user interaction is required. The record does not specify the exact endpoint or protocol used.

Exploitation

CISA added it to KEV on 2024-07-17 with a remediation due date of 2024-08-07, and EPSS is 0.99614 (99.9th percentile), indicating active exploitation and very high likelihood. No ransomware campaign use is documented in the record.

What to do

• Apply the SolarWinds Serv-U security update referenced in the vendor advisory CVE-2024-28995 as the first action.
• If patching cannot be completed immediately, follow the vendor's mitigation guidance or discontinue use of the product as directed by CISA KEV.
• Restrict network access to the Serv-U service to trusted management networks and block it from the public internet.
• Rotate credentials and secrets stored on or reachable from the Serv-U host, since file read may expose them.
• Monitor the vendor advisory and CISA KEV entry for updated guidance.

Detection

• Review Serv-U and web/proxy logs for path traversal patterns such as ../, encoded variants (%2e%2e%2f), and requests for sensitive files like web.config, .env or SSH keys.
• Alert on unexpected reads of configuration, credential or system files by the Serv-U process.
• Hunt for anomalous outbound connections or file access from the Serv-U host that could indicate post-exploitation data collection.
• Correlate Serv-U access logs with file integrity monitoring on sensitive paths to catch traversal attempts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.