Critical Vulnerabilities in SolarWinds Serv-U Require Immediate Patching

SolarWinds has identified 15 critical vulnerabilities in its Serv-U software, including two that allow remote code execution (RCE). The vulnerabilities, with CVSS scores of 9.1, affect versions 15.5.4 HF1 and below, as well as Serv-U 2026.3. Attackers can exploit these vulnerabilities to execute arbitrary code and escalate privileges. The vulnerabilities were published on 2026-07-21, and users are urged to apply patches immediately to mitigate risks. The Serv-U software is widely used for managed file transfers, making it a significant target for cybercriminals. Previous incidents, such as the MOVEit attacks, highlight the dangers of unpatched vulnerabilities in data transfer solutions. Administrators are advised to review the release notes for detailed information on the vulnerabilities and the necessary updates.

Key Points: • SolarWinds Serv-U has 15 critical vulnerabilities, including two allowing remote code execution. • Patches are available for affected versions, and immediate application is recommended. • The vulnerabilities could lead to significant data breaches and exploitation by cybercriminals.