What Are Hackers Searching for in Solar Winds Serv-U (CVE-2024-28995)?

Summary: GreyNoise's honeypots have been monitoring exploit attempts against the SolarWinds Serv-U vulnerability, CVE-2024-28995, and recorded which files attackers are seeking. The data shows attackers targeting key system files and credential-containing configuration files while scanning for vulnerable systems in real time.
Why it matters: The files attackers are reaching for first are the ones holding credentials, so a single unpatched Serv-U instance can hand over the keys rather than just a foothold.

Read the original at GreyNoise Blog ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2024-28995
Related: CVE-2024-28995: Solar Winds Serv-U Path Traversal Vulnerability Known Exploited Vulnerabilities · Jul 17, 2024
Solar Winds Serv-U (CVE-2024-28995) exploitation: We see you! | Grey Noise Blog Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026