What’s Vulnerable › Vulnerabilities

CVE-2021-35223: Execute Command Function Allows Remote Code Execution (RCE)Vulnerability

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-08-31 · updated 2026-06-17
• Weakness: CWE-20

Description

The Serv-U File Server allows for events such as user login failures to be audited by executing a command. This command can be supplied with parameters that can take the form of user string variables, allowing remote code execution.

Affected products

• SolarWinds Serv-U: before 15.2.4 — fixed in 15.2.4

How to fix

Upgrade to a fixed version: SolarWinds Serv-U 15.2.4. Check the vendor advisory for mitigations.

References

• https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-2-4_release_notes.htm
• https://support.solarwinds.com/SuccessCenter/s/article/Execute-Command-Function-Allows-Remote-Code-Execution-RCE-Vulnerability-CVE-2021-35223?language=en_US
• https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35223
• https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-2-4_release_notes.htm
• https://support.solarwinds.com/SuccessCenter/s/article/Execute-Command-Function-Allows-Remote-Code-Execution-RCE-Vulnerability-CVE-2021-35223?language=en_US
• https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35223

Get alerted when CVE-2021-35223 or the next vulnerability affects your stack