Back Heise.De

Data transfer software Serv-U has 15 critical security vulnerabilities

Heise.De • July 22, 2026

SolarWinds is patching a total of 15 critical security vulnerabilities and one of medium severity with the update to Serv-U 2026.3. The impacts range from privilege escalation and information leaks to the execution of injected malware from the network.

In the Release Notes for Serv-U 2026.3 , SolarWinds lists the individual security vulnerabilities. The software, expanded from an FTP server to a Managed File Transfer system, has received 15 CVE entries for critical vulnerabilities: CVE-2026-28302, CVE-2026-28304 through CVE-2026-28314, and CVE-2026-28316, CVE-2026-28317, and CVE-2026-28321 have a risk rating of “ critical ” with a CVSS score of 9.1 . The vulnerability entry CVE-2026-28315 stands out with a CVSS score of 6.2 and a risk rating of “ medium; ” it is a cross-site scripting vulnerability that can enable session hijacking or unauthorized viewing of an admin account's information.

Interested parties can also find information on new features and improvements that Serv-U 2026.3 brings in the release notes. There, SolarWinds explains, for example, under “General Improvements,” that OpenSSL version 3.0.21 is included, which closes further security vulnerabilities, and that there are general “security improvements.” Bug fixes include, for example, crashes due to HTTP headers with irrelevant “content-encoding: deflate” entries or denial-of-service situations due to anonymous SSH-FTP sessions.

IT managers should not take vulnerabilities in SolarWinds lightly but should promptly apply available software patches. In early June, for example, attackers exploited a denial-of-service vulnerability in Serv-U from the internet . Cybercriminals particularly favor attacking vulnerabilities in such data transfer solutions because they allow access to data that they can then use to extort companies for ransom. This was done en masse by the cyber gang Cl0p in mid-2023 with vulnerabilities in the data transfer software MOVEit from Progress.

This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in SolarWinds Serv-U Require Immediate Patching SolarWinds has identified 15 critical vulnerabilities in its Serv-U software, including two that allow remote code execution (RCE). The vulnerabilities, with CVSS scores of 9.1, affect versions 15.5.4 HF1 and below, as well as Serv-U 2026.3. Attackers can exploit these vulnerabilities to execute arbitrary code and escalate privileges. The vulnerabilities were published on 2026-07-21, and users are urged to apply patches immediately to mitigate risks. The Serv-U software is widely used for managed file transfers, making it a significant target for cybercriminals. Previous incidents, such as the MOVEit attacks, highlight the dangers of unpatched vulnerabilities in data transfer solutions. Administrators are advised to review the release notes for detailed information on the vulnerabilities and the necessary updates. 6 sources 73

Extracted Entities

Data transfer software Serv-U has 15 critical security vulnerabilities

The full story

Extracted Entities

Attack Types (2)

CVEs (7)

CWE Weaknesses (3)

Domains (1)

Platforms (1)

Tools (1)

Vulnerabilities (1)