CVE-2021-35211

What it actually does

CVE-2021-35211 is a critical remote code execution vulnerability in SolarWinds Serv-U Managed File Transfer and Serv-U Secure FTP for Windows before version 15.2.3 HF2. The flaw is a memory-corruption condition reachable over the network, commonly associated with the Serv-U SSH/SFTP service path. An unauthenticated remote attacker can trigger the vulnerability without user interaction and escape normal memory boundaries to execute attacker-controlled code. Successful exploitation can give the attacker the privileges of the Serv-U service process on the host, enabling full compromise of the file-transfer server and potential follow-on activity against stored files, credentials, integrations, and adjacent systems.

Why it matters to the business

A compromised Serv-U server can expose sensitive transferred files, customer or partner data, credentials used for file exchange, and business workflows that depend on managed file transfer. Because the vulnerability has a CVSS score of 10.0, a high EPSS likelihood, confirmed exploitation in the wild, CISA KEV listing, and known ransomware use, internet-facing Serv-U deployments should be treated as emergency remediation targets. Organizations relying on Serv-U for regulated or partner data exchange may face data breach obligations, service disruption, ransomware intrusion, and loss of trust with customers or counterparties.

How an attack unfolds

An attacker first identifies an exposed SolarWinds Serv-U instance, particularly one offering SSH/SFTP services on the network. The attacker sends crafted network traffic that triggers the memory-corruption vulnerability in the vulnerable Serv-U component. If exploitation succeeds, the Serv-U process can execute attacker-controlled code on the Windows host. From there, the attacker typically runs reconnaissance commands, drops tooling, creates persistence, accesses files managed by the transfer service, harvests credentials or configuration secrets, and attempts lateral movement. In ransomware scenarios, the compromised file-transfer server can become an initial foothold used to stage payloads, steal data, disable defenses, and move deeper into the environment.

How to fix it

Upgrade SolarWinds Serv-U Managed File Transfer and Serv-U Secure FTP for Windows to version 15.2.3 HF2 or later. If immediate upgrading is not possible, remove the Serv-U service from direct internet exposure, restrict access to trusted source IP ranges through firewall or VPN controls, and disable SSH/SFTP access if it is not required. Rotate credentials, API keys, SSH keys, and service-account secrets associated with Serv-U after patching if the server was exposed while vulnerable. Review Serv-U integrations, scheduled tasks, transfer directories, and administrative accounts for unauthorized changes. Because this vulnerability is in the CISA Known Exploited Vulnerabilities catalog and is associated with ransomware activity, mitigation alone should be considered temporary; full upgrade and compromise assessment are strongly recommended.

How to confirm the fix worked

Confirm the installed Serv-U version is 15.2.3 HF2 or later through the Serv-U administrator console, installed program inventory, file version metadata, or software management tooling. Verify that vulnerable Windows Serv-U hosts are no longer running pre-15.2.3 HF2 builds. Confirm that SSH/SFTP exposure is limited to approved networks and that public internet access is removed unless explicitly required. Validate firewall rules, network ACLs, and external attack-surface scans to ensure only intended ports are reachable. After upgrading, restart the Serv-U service and confirm normal file-transfer operation. Perform a post-remediation review of Serv-U logs, Windows event logs, EDR telemetry, and file integrity monitoring to ensure there are no signs of prior compromise.

Typical attack path

1. Scan the internet or target address ranges for exposed SolarWinds Serv-U services, especially SSH/SFTP endpoints.
2. Fingerprint the service version or behavior to identify vulnerable Serv-U Managed File Transfer or Serv-U Secure FTP installations before 15.2.3 HF2.
3. Send crafted network traffic to trigger the remote memory-corruption condition.
4. Achieve code execution in the context of the Serv-U service process on the Windows host.
5. Run system reconnaissance and enumerate files, accounts, network connections, and Serv-U configuration.
6. Access or exfiltrate files handled by the managed file-transfer service and attempt to recover stored credentials or keys.
7. Deploy additional tooling, persistence mechanisms, web shells, reverse shells, or command execution payloads.
8. Move laterally using harvested credentials or trusted file-transfer relationships.
9. In ransomware-motivated intrusions, stage data theft and encryption operations after establishing broader control.

How to detect it

Investigate Serv-U hosts that were vulnerable or externally reachable before upgrade. Review Serv-U debug, SSH/SFTP, FTP, administrative, and transfer logs for crashes, access-violation exceptions, malformed SSH activity, unusual login attempts, unexpected file downloads, new administrative users, and configuration changes. In Windows event logs and EDR telemetry, look for Serv-U service process behavior that is abnormal for a file-transfer server, especially child processes such as command shells, PowerShell, script interpreters, archive tools, credential-dumping tools, discovery commands, or outbound network utilities. Examine Security, System, PowerShell, Sysmon, and application logs for process creation, service creation, scheduled task creation, new local users, remote logons, privilege changes, and suspicious outbound connections originating from the Serv-U host. Review file system artifacts for recently created executables, scripts, compressed archives, staging directories, modified Serv-U configuration files, or unexpected files in transfer directories. Because exploitation has been observed in the wild and the issue is associated with ransomware activity, absence of a single IOC should not be treated as proof of no compromise; combine log review, EDR hunting, credential review, and network-flow analysis.

• EXCEPTION: C0000005; CSUSSHSocket::ProcessReceive
• CSUSSHSocket::ProcessReceive
• EXCEPTION: C0000005
• DebugSocketLog.txt
• Serv-U.exe -> cmd.exe
• Serv-U.exe -> powershell.exe
• Serv-U.exe -> pwsh.exe
• Serv-U.exe -> wscript.exe
• Serv-U.exe -> cscript.exe
• Serv-U.exe -> mshta.exe
• Serv-U.exe -> rundll32.exe
• Serv-U.exe -> regsvr32.exe
• Serv-U.exe -> certutil.exe
• Serv-U.exe -> bitsadmin.exe
• Serv-U.exe -> whoami.exe
• Serv-U.exe -> net.exe
• Serv-U.exe -> nltest.exe
• Serv-U.exe -> ipconfig.exe
• Serv-U.exe -> tasklist.exe
• Serv-U.exe -> schtasks.exe
• Serv-U.exe -> sc.exe
• Serv-U.exe -> netstat.exe

What your security team should do

• Treat exposed Serv-U Managed File Transfer and Serv-U Secure FTP for Windows systems as critical-priority assets and upgrade to 15.2.3 HF2 or later immediately.
• If upgrade cannot be completed immediately, block internet access to Serv-U and restrict SSH/SFTP access to known trusted source addresses.
• Run a compromise assessment on any vulnerable Serv-U server that was reachable from untrusted networks, even if patching has been completed.
• Search Serv-U debug and transfer logs for access violations, SSH processing exceptions, suspicious authentication patterns, unusual file downloads, and unexpected administrative changes.
• Hunt EDR and Windows telemetry for Serv-U spawning command shells, scripting engines, reconnaissance tools, or network utilities.
• Rotate Serv-U administrative credentials, service-account passwords, SSH keys, and any credentials stored in or used by transfer workflows if exposure is suspected.
• Review inbound and outbound network connections from Serv-U hosts for suspicious destinations, reverse shells, data staging, or unusual transfer volumes.
• Check for newly created local users, scheduled tasks, services, autoruns, firewall rule changes, and recently written executables on Serv-U hosts.
• Prioritize this issue in vulnerability management reporting because it is KEV-listed, actively exploited, high-EPSS, and associated with ransomware campaigns.
• Retain relevant logs and disk images where feasible before rebuilding or reimaging systems suspected of compromise.