CVE-2024-28995
SolarWinds Serv-U Path Traversal Vulnerability
Published Jun 6, 2024 · updated Jun 17, 2026 · solarwinds serv-u
SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine.
Timeline
Detection, updates, and resolution for this record.
Jun 6, 2024 · Catalog
Detected
SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine.
Jul 17, 2024 · CISA KEV
Known exploited
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Aug 7, 2024 · CISA KEV
Remediation due
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Jun 17, 2026 · Catalog
Updated
SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine.
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA due date Aug 7, 2024
Affected
- cpe solarwinds/serv-uversion unspecified
- cpe solarwinds/serv-u15.4.2
- vendor SolarWinds Serv-Uversion unspecified
Sources
- CISA KEVCVE-2024-28995
SolarWinds Serv-U contains a path traversal vulnerability that allows an attacker access to read sensitive files on the host machine.
cisa.gov - CVE.orgCVE-2024-28995
Official CVE identifier
cve.org - FIRST EPSSCVE-2024-28995
30-day exploitation probability 99.6%
first.org - Exploit Database52311
Public archive entry. The exploit body is not stored here.
exploit-db.com - Metasploit Modulesauxiliary_gather/solarwinds_servu_fileread_cve_2024_28995
Public module reference (normal). Module source is not copied into this catalog.
rapid7.com - NIST NVDCVE-2024-28995
SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine.
nvd.nist.gov