Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
1DescriptionNVD
SolarWinds Serv-U File Server before 15.2.1 allows information disclosure via an HTTP response.
AnalysisAI
SolarWinds Serv-U File Server before 15.2.1 allows information disclosure via an HTTP response. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
SolarWinds Serv-U File Server before 15.2.1 allows information disclosure via an HTTP response. Affected products include: Solarwinds Serv-U. Version information: before 15.2.1.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
Remote denial-of-service in SolarWinds Serv-U allows unauthenticated attackers to crash the Serv-U service by sending sp
Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Mem
SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive fil
In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files (that include users' pas
A denial of service vulnerability in SolarWinds Serv-U before 15.1.6 HFv1 allows an authenticated user to crash the appl
Share/IncomingWizard.htm in SolarWinds Serv-U before 15.2.3 mishandles the user-supplied SenderEmail parameter, aka "Sha
Second type confusion vulnerability in SolarWinds Serv-U. Different attack vector from CVE-2025-40539 but same impact —
Type confusion vulnerability in SolarWinds Serv-U enables arbitrary code execution. Second critical Serv-U vulnerability
Broken access control in SolarWinds Serv-U allows unauthorized user creation by exploiting privilege assignment flaws. F
IDOR vulnerability in SolarWinds Serv-U allows accessing objects belonging to other users. Fourth critical Serv-U vulner
SolarWinds Serv-U is vulnerable to a directory traversal vulnerability where remote code execution is possible depending
Serv-U server responds with valid CSRFToken when the request contains only Session. Rated high severity (CVSS 8.8), this
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today