TL;DR

SolarWinds has issued patches for four critical CVEs affecting Serv-U, all rated 9.1 CVSS severity, allowing potential RCE via broken access control and other issues.

What happened

["Four critical flaws patched in SolarWinds' Serv-U", 'Vulnerabilities could allow attackers to execute arbitrary code remotely']

Why it matters for ops

['Remote Code Execution (RCE) possible through vulnerabilities', 'High severity due to CVSS scores of 9.1']

Mitigation

  • Apply the latest security updates for Serv-U
  • Monitor access control logs and system permissions

Action items

  • Update to patched version of Serv-U immediately
  • Review network configurations for potential exposure

Detection IOCs

  • Unpatched Serv-U software versions
  • Increased network traffic from unauthorized sources

Source link

https://thehackernews.com/2026/02/solarwinds-patches-4-critical-serv-u.html