# CVE-2024-28995: SolarWinds Serv-U Exploit Leads to Server Crashes

> CISA warns of active exploitation of SolarWinds Serv-U CVE-2024-28995. Attackers are leveraging this directory traversal flaw to crash vulnerable servers.

- Published: 2026-06-05T20:41:11.000Z
- Severity: high
- Category: Vulnerabilities
- Tags: CVE-2024-28995, SolarWinds, Serv U, CISA KEV, Directory Traversal
- Author: Runtime Rebel Intel
- Primary source: https://www.bleepingcomputer.com/news/security/cisa-hackers-now-exploit-solarwinds-serv-u-flaw-to-crash-servers/
- Canonical: https://runtimerebel.com/blog/cve-2024-28995-solarwinds-serv-u-exploit-leads-to-server-crashes

## Key points

- Attackers are exploiting a directory traversal flaw to read sensitive files and crash vulnerable SolarWinds Serv-U instances.
- Impacted systems include SolarWinds Serv-U FTP Server and MFT Server versions 15.4.2 HF 1 and all previous releases.
- Organizations should immediately update SolarWinds Serv-U to version 15.4.2 HF 2 to remediate this high-severity vulnerability.

The Cybersecurity and Infrastructure Security Agency (CISA) recently updated its Known Exploited Vulnerabilities (KEV) catalog to include a high-severity flaw impacting SolarWinds Serv-U. The vulnerability, tracked as [CVE-2024-28995](/cve/cve-2024-28995), is a directory traversal issue that allows unauthenticated threat actors to read arbitrary files on the host system. According to [Bleeping Computer](https://www.bleepingcomputer.com/news/security/cisa-hackers-now-exploit-solarwinds-serv-u-flaw-to-crash-servers/), security researchers and federal authorities have observed attackers expanding their operations from simple data theft to causing denial-of-service conditions by crashing targeted servers.

## Technical Analysis of the SolarWinds Serv-U 15.4.2 HF 1 Directory Traversal

This [CVE](/glossary#cve) originates from improper validation of URI paths within the Serv-U management console and file transfer interface. By sending a specially crafted GET request, an attacker can bypass folder restrictions and traverse the file system. In many observed instances, this is used to access sensitive system files such as /etc/passwd on Linux or win.ini and configuration files on Windows hosts. 

While the vulnerability does not provide direct [RCE](/glossary#rce) out of the box, the ability to read configuration files often facilitates further compromise. Attackers can extract credentials or session tokens that enable [Privilege Escalation](/glossary#privilege-escalation) within the application or the broader network. More recently, exploitation attempts have resulted in service instability. When the application fails to handle malformed traversal requests or when specific system files are accessed in a way that locks the process, the Serv-U service may hang or terminate, leading to a complete outage for file transfer operations.

## How to detect CVE-2024-28995 exploit attempts

Security teams should focus on identifying unusual web requests in their HTTP logs. Indicators of compromise typically include repeated occurrences of dot-dot-slash sequences (../) or their URL-encoded equivalents. Because the flaw is being actively exploited in the wild, [SOC](/glossary#soc) analysts must correlate these log entries with any unexpected service restarts or file access alerts.

Monitoring for this specific [TTP](/glossary#ttp) is essential for organizations that cannot patch immediately. However, manual detection is often insufficient against automated scanning tools. Implementing [EDR](/glossary#edr) rules that trigger when the Serv-U process (Serv-U.exe or similar) accesses system files outside of its installation directory is a highly effective way to identify [IoC](/glossary#ioc) patterns associated with this vulnerability. Integrating these logs into a [SIEM](/glossary#siem) can provide the necessary visibility to catch early-stage reconnaissance before an attacker moves toward [Lateral Movement](/glossary#lateral-movement).

## SolarWinds Serv-U Patch Guidance and Remediation

SolarWinds has released a hotfix to address this issue. The vulnerability affects Serv-U FTP Server, Serv-U Gateway, and Serv-U MFT Server. Organizations running version 15.4.2 HF 1 or any earlier version are at risk. The [CVSS](/glossary#cvss) score of 8.6 reflects the severity of the data exposure, but CISA’s addition to the KEV catalog emphasizes that the risk is not theoretical.

To remediate the threat, administrators must upgrade to SolarWinds Serv-U version 15.4.2 HF 2. Given that this is a [Zero-Day](/glossary#zero-day) style threat for unpatched systems, CISA has set a strict deadline for federal agencies to apply the update. Private sector organizations should follow suit, especially those in critical infrastructure sectors that rely on Serv-U for secure data exchange.

**Related:** [CISA Flags SolarWinds, Ivanti, and Workspace One Flaws in KEV Update](/blog/cisa-flags-solarwinds-ivanti-and-workspace-one-flaws-in-kev-update), [CVE-2026-1603: CISA Warns of Active Ivanti and SolarWinds Exploitation](/blog/cve-2026-1603-cisa-warns-of-active-ivanti-and-solarwinds-exploitation)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/cve-2024-28995-solarwinds-serv-u-exploit-leads-to-server-crashes