SolarWinds Serv-U path-traversal flaw actively exploited in attacks

The report describes active exploitation of a high-severity SolarWinds Serv-U directory traversal vulnerability (CVE-2024-28995) that permits unauthenticated arbitrary file reads. Public PoC code and bulk scanners have been released, Rapid7 and GreyNoise observed exploitation attempts targeting files such as /etc/passwd and win.ini, and SolarWinds issued Hotfix 15.4.2.157—administrators are urged to apply the update immediately.