Critical Remote Code Execution in SolarWinds Serv‑U (CVE‑2021‑35211)
What It Is – SolarWinds Serv‑U contains an unspecified memory‑escape flaw that allows an unauthenticated attacker to execute arbitrary code on the host running the FTP server.
Exploitability – The vulnerability is publicly disclosed (CVE‑2021‑35211) and assigned a CVSS v3.1 base score of 9.8 (Critical). No public exploit code has been released, but the severity and remote‑code‑execution vector make it a high‑risk candidate for weaponisation.
Affected Products – SolarWinds Serv‑U (all supported versions prior to the vendor‑issued patch released March 2022).
Why It Matters for Trust & Control Assurance
- Vulnerability Management – Demonstrates the need for a documented process that continuously inventories, assesses, and remediates software flaws; a gap here weakens audit evidence for any framework that requires timely patching.
- Defensible Evidence – Maintaining proof of patch deployment and verification feeds directly into continuous control monitoring, giving enterprise buyers confidence in your security posture.
- Supply‑Chain Resilience – Serv‑U is often embedded in critical file‑transfer workflows; an unpatched instance can become an entry point for broader compromise, impacting the trust you extend to partners and customers.
Recommended Actions
- Identify every Serv‑U instance in your environment via asset inventory.
- Apply the SolarWinds patch released on 2022‑03‑02 or upgrade to the latest major version.
- Verify remediation with a controlled test or vulnerability scanner.
- Record patch‑deployment evidence in your control‑mapping repository for audit readiness.
- Review and tighten your vulnerability‑management policy to ensure future flaws are addressed within the vendor‑specified window.
Source: CISA KEV – CVE‑2021‑35211