CISA Known Exploited Vulnerabilities Directory

Explore every threat in the CISA Known Exploited Vulnerabilities (KEV) catalog, enhanced with plain-English executive analysis, AWS relevance, and technical remediation guidance.

Showing 1–4 of 4 records

CVE Vendor Product Added Due Status
CVE-2026-28318 — SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability
SolarWinds Serv-U contains an uncontrolled resource consumption vulnerability that allows specially crafted POST requests using the Content-Encoding: deflate header to crash the Serv-U service without authentication.
 SolarWinds Serv-U Jun 5, 2026 Jun 19, 2026
CVE-2024-28995 — SolarWinds Serv-U Path Traversal Vulnerability
SolarWinds Serv-U contains a path traversal vulnerability that allows an attacker access to read sensitive files on the host machine.
 SolarWinds Serv-U Jul 17, 2024 Aug 7, 2024
CVE-2021-35247 — SolarWinds Serv-U Improper Input Validation Vulnerability
SolarWinds Serv-U versions 15.2.5 and earlier contain an improper input validation vulnerability that allows attackers to build and send queries without sanitization.
 SolarWinds Serv-U Jan 21, 2022 Feb 4, 2022
CVE-2021-35211 — SolarWinds Serv-U Remote Code Execution Vulnerability
SolarWinds Serv-U contains an unspecified memory escape vulnerability which can allow for remote code execution.
 SolarWinds Serv-U Nov 3, 2021 Nov 17, 2021 Ransomware