CVE-2021-3154: SolarWinds Serv-U

High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days.

An issue was discovered in SolarWinds Serv-U before 15.2.2. Unauthenticated attackers can retrieve cleartext passwords via macro Injection. NOTE: this had a distinct fix relative to CVE-2020-35481.

Affected products

• SolarWinds Serv-U: before 15.2.2 (fixed in 15.2.2)

Published 2021-05-04. Last modified 2026-06-17.