CVE-2024-28995: SolarWinds Serv-U directory traversal, actively exploited
The short version: SolarWinds Serv-U — the managed file-transfer, FTP, and gateway product — has a directory-traversal flaw (CVE-2024-28995) that lets an unauthenticated attacker read arbitrary files from the host operating system. Public proof-of-concept exploits appeared quickly and it was exploited in the wild, so it sits in CISA's KEV catalog. If you run an affected build, patch it. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — in practice (see below) |
| CVSS v3.1 (NVD) | 8.6 — High · AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
| EPSS | 99.61% · 99.9th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2024-08-07 |
| Known exploited? | Yes — public PoC and in-the-wild exploitation shortly after disclosure |
| Vulnerability type | CWE-22 path traversal → unauthenticated arbitrary file read |
| Requires authenticated session? | No — pre-authentication |
| Affected | SolarWinds Serv-U 15.4.2 Hotfix 1 and earlier |
| Fixed in | Serv-U 15.4.2 Hotfix 2 (15.4.2.157) or later |
What you need to know
CVE-2024-28995 is a directory (path) traversal in Serv-U. By sending a crafted request with traversal sequences, an unauthenticated attacker escapes the intended web root and reads files elsewhere on the host — configuration, credentials in plaintext files, and other sensitive material the service account can reach.
It's an information-disclosure bug, not remote code execution, but the context makes it matter:
- It's an internet-facing file-transfer appliance. Serv-U is meant to be reachable so people can move files — which means the vulnerable surface is exposed by design.
- It was weaponized fast. Working exploits were public within days of the June 2024 disclosure, and opportunistic scanning and exploitation followed — which is why it's in KEV.
- What it reads can unlock more. A stray secret or config file lifted this way often becomes the first step in a larger intrusion.
How serious we see it
High — in practice.
The 8.6 base score is fair, and the practical risk tracks it closely: unauthenticated, network-reachable, and confirmed exploited against an appliance whose whole job is to be exposed. It stops short of Critical because it reads files rather than executing code — but a KEV-listed, mass-scanned file read on an MFT server is squarely a "patch this now" finding. The reassuring part is that it's narrow and fixable: it affects specific Serv-U builds, the fix is published, and you can tell quickly whether it applies to you.
Recommendations
Straight from SolarWinds' advisory and CISA:
- Patch now. Upgrade to Serv-U 15.4.2 Hotfix 2 or later.
- Confirm your exposure first. Verify whether you run an internet-facing Serv-U instance and which build.
- Restrict reachability. Until patched, limit access to the Serv-U service to trusted IP addresses.
- Hunt for prior use. Review access logs for traversal patterns (encoded
../sequences) and unexpected file-read activity. - Rotate anything that may have leaked. If sensitive files were readable, treat the secrets in them as exposed and rotate them.
How BreachRisk sees it
BreachRisk starts from the outside, the way an attacker does. From little more than your domain it discovers internet-facing Serv-U instances, fingerprints the product and version, and flags exposure tied to CVE-2024-28995 — pushed to the top of your results because it's in KEV. Where authorized, it goes a step further than a scanner: it performs a safe, bounded read check against the traversal path to confirm the exposure actually holds, as a benign verification rather than a data grab.
That continuous, outside-in view is the point — when a file-transfer flaw is being exploited in the wild, the exposed server is already mapped, so you go straight to patch-and-verify.