SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability

Who is affected

How to fix it

Upgrade SolarWinds Serv-U to the fixed release or hotfix and restrict file-transfer service exposure. Because Serv-U handles credentials and external file uploads, remediation should include log review, user cleanup, and credential rotation.

1. Inventory all Serv-U FTP, FTPS, SFTP, and gateway servers, including internet-facing and partner-facing deployments.
2. Install the SolarWinds fixed Serv-U release or hotfix identified in the vendor advisory.
3. Restrict Serv-U management and file-transfer access to approved networks, partners, and VPN paths where possible.
4. Disable unused protocols, anonymous access, legacy ciphers, and unnecessary virtual folders.
5. Review Serv-U domain users, admin accounts, SSH keys, file permissions, scripts, and event rules for unauthorized changes.
6. Inspect logs, crash reports, uploaded files, and outbound connections from the vulnerable window.
7. Rotate Serv-U administrator credentials, user passwords, SSH keys, API credentials, and downstream secrets if compromise is suspected.

Verify the fix

• Confirm the Serv-U version and hotfix level match the SolarWinds fixed guidance.
• Validate management access is not reachable from untrusted networks.
• Review Serv-U logs for failed exploit attempts, unexpected logins, file uploads, or rule changes.
• Test approved FTP/SFTP transfer workflows after the update.
• Run a Fixnx scan and confirm no public management interface or vulnerable service guidance is exposed.

Related categories

Trusted references

FAQ