Is CVE-2024-28995 (SolarWinds Serv-U Path Traversal Vulnerability) being exploited in the wild?

Yes. CISA added CVE-2024-28995 to its Known Exploited Vulnerabilities catalogue on 17 July 2024, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. SolarWinds Serv-U contains a path traversal vulnerability that allows an attacker access to read sensitive files on the host machine.

How CISA’s KEV listing changes the answer

The practical meaning of a KEV listing is that this is not just a theoretical CVE. For defenders, the question becomes whether the vulnerable Serv-U instances are exposed anywhere in the estate, whether they are internet-facing, and whether logs show unusual file access or traversal attempts around the date of CISA’s listing. Treat it as an active exploitation indicator, not a severity discussion.

Use the KEV record, the vendor advisory, and your asset inventory together. The most useful first step is to identify every Serv-U deployment, confirm whether it matches the vulnerable product family, and determine whether compensating controls already limit file-system reach. That is the point at which a scanner result becomes an actionable response decision.

For a quick triage view, the Zero-Day and Exploited Vulnerabilities Guide is the most direct internal starting point because it covers KEV-driven prioritisation, emergency mitigation, and post-patch hunting.

Why path traversal in Serv-U matters operationally

Path traversal is dangerous because it can turn a file-serving or file-management weakness into host-level data exposure. In this case, the key concern is not only the application boundary, but what the application account can read on the underlying machine, including configuration files, logs, keys, and other sensitive material that may widen the blast radius beyond Serv-U itself.

That matters because exploitation does not necessarily stop at disclosure of one file. Sensitive configuration can reveal credentials, internal paths, or trust relationships that help an attacker move from simple read access to broader compromise. If the application runs with excessive permissions, the real exposure is often larger than the CVE description suggests.

The attack pattern is well illustrated by the Web Application Attacks Guide, which groups path traversal with other input-handling failures that let attackers escape intended resource boundaries.

For a broader exploitation-and-response lens, CISA Known Exploited Vulnerabilities Catalog is the authoritative public source for confirming why this issue should be treated as a live response item rather than a normal backlog ticket.

What to do if patching is delayed

If immediate remediation is not possible, focus on exposure reduction rather than waiting passively. Restrict who can reach Serv-U, remove unnecessary internet exposure, and review whether the service account has broader file-system permissions than it needs. If the product is reachable from untrusted networks, assume attackers will test traversal paths quickly once the vulnerability is public.

Then validate whether any sensitive files could already have been read. That means checking web and application logs for abnormal file requests, reviewing authentication and admin activity around the KEV date, and looking for secondary indicators such as unexpected configuration access or access to files that should never be served. If credentials, session material, or secrets were stored in reachable locations, rotate them and reissue them from a clean source.

For patch planning and exception handling, the Vulnerability Management Guide is useful because it ties KEV, prioritisation, verification, and remediation tracking into one response workflow.

The vendor and the CVE Program remain the right references for record-level details, while the NIST National Vulnerability Database is useful for cross-checking the canonical record and affected-product metadata before you close the ticket.

Risk and Threat Considerations

Actively exploited traversal flaws tend to be high-value because they are straightforward to test at scale and can expose data even when they do not immediately produce code execution. Once a file-read path exists, defenders must assume the attacker will look for configuration files, logs, or credentials that convert a narrow application flaw into broader host or environment compromise.

Failure mechanism: The application accepts attacker-controlled path input and resolves it outside the intended directory boundary, allowing access to sensitive host files that were never meant to be reachable through Serv-U.

Impact: Exposure of configuration, credentials, tokens, or internal file contents can enable follow-on intrusion, privilege escalation, lateral movement, or further targeted exploitation against the host and adjacent systems.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack surface, CIS Controls v8 and NIST SP 800-53 Rev 5 set the technical controls, and ISO/IEC 27001:2022 defines the regulatory obligations.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	KEV-listed flaws require prioritized detection, remediation, and verification.
Recommendation — Prioritize this CVE in continuous vulnerability management and verify remediation quickly.
NIST SP 800-53 Rev 5	RA-5 — Vulnerability Monitoring and Scanning	The answer centers on identifying exposed instances and verifying exploitation risk.
	SI-2 — Flaw Remediation	The CVE requires timely correction or mitigation after exploitation evidence.
Recommendation — Scan for Serv-U exposure and track remediation status until the flaw is closed. Apply the vendor fix or mitigation and document exception handling if delay is unavoidable.
ISO/IEC 27001:2022	A.8.8 — Management of technical vulnerabilities	Actively exploited CVEs are handled through technical vulnerability management and response.
Recommendation — Treat this issue as a managed technical vulnerability and expedite remediation.
MITRE ATT&CK	T1006 — File and Directory Discovery	Path traversal and sensitive-file discovery map to attacker file-access behaviour.
	T1083 — File and Directory Discovery	The flaw exposes host files, making file discovery and collection the relevant attacker behaviour.
Recommendation — Hunt for file and directory discovery around Serv-U and investigate abnormal file reads. Monitor for abnormal attempts to enumerate or collect host files through the service.

Practitioner Guidance

What to verify: Confirm every Serv-U instance, the hosting OS, the exposed network path, and whether any service account or admin credential material could be reached through readable files. If you cannot prove the instance is isolated and remediated, treat it as potentially compromised until reviewed.

Decision rule: If the system is internet-facing or handles sensitive file paths, prioritise containment and credential review before deep forensic work on lower-risk assets. If patching must wait, reduce exposure first, then collect logs and evidence from a known-good state.

Practitioner takeaway: For KEV-listed traversal flaws, the key judgement is not whether exploitation is possible in theory, but whether the exposed service could have read something valuable enough to matter, and whether you have already rotated anything that exposure may have revealed.