CVE-2021-35211 SolarWinds Serv-U Remote Code Execution

Exploited in the wild Critical 9.0 Published 14 Jul 2021 Updated 21 Oct 2025

Remote attackers can exploit a memory corruption flaw in Serv-U to execute arbitrary code and gain privileged access to the host system.

Exploited in the wild: Since 3 Nov 2021
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-35211?

CVE-2021-35211 is a critical memory corruption vulnerability in Solarwinds Serv-U, published on 14 Jul 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerability. If exploited, a threat actor may be able to gain privileged access to the machine hosting Serv-U Only. SolarWinds Serv-U Managed File Transfer and Serv-U Secure FTP for Windows before 15.2.3 HF2 are affected by this vulnerability.

Weakness: CWE-787

Which versions are affected by CVE-2021-35211?

It affects 1 product.

Products include Solarwinds Serv-U.

How do I fix CVE-2021-35211?

No fix has been published for CVE-2021-35211 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 17 Nov 2021.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2021-35211 being exploited?

Yes. Attackers have exploited CVE-2021-35211 in the wild since at least 3 Nov 2021, including in ransomware campaigns.

Public exploit code: 1 Nuclei template and 3 proofs of concept on GitHub.

All Solarwinds Serv-U vulnerabilities

Sources

Also known as GHSA-cpmg-9xq8-3934.