Moving off Serv-U
Stop patching your Serv-U server. Keep everything your partners rely on.
SolarWinds Serv-U runs on a Windows or Linux server you patch, license and expose to the internet yourself. SFTP.cloud runs that part for you. Your hostname, accounts, keys and storage stay as they are, and the inbound port on your network closes.
Serv-U details checked against SolarWinds, CISA and NVD sources on 18 October 2026.
Who patches the server
You, on every hotfix
We do
Inbound ports on your network
Open to the internet
None. The Connector only dials out
Hostname, accounts and storage
Yours
Still yours, unchanged
01Why teams move
Attackers have used Serv-U flaws in 2021, 2024 and 2026. Your server is on your network.
Running Serv-U yourself means you own its exposure: the open port, the patch window and the server that holds your files and partner credentials.
June 2026CVE-2026-28318
One crafted request takes the service down.
A remote attacker with no login could crash Serv-U with a single HTTP request. CISA confirmed attacks two days after the hotfix shipped and gave federal agencies two weeks to patch. Every partner transfer stops while the service is down.
July 2026CVE-2026-28312
A group user could become system administrator.
Rated critical at 9.1, the flaw let any account in a Serv-U group raise its access to system administrator and run code as root. It was fixed alongside a second privilege escalation, CVE-2026-28317, in the same release.
2021 and 2024CVE-2021-35211 · CVE-2024-28995
Both on CISA’s list of exploited flaws.
In 2021 a flaw in Serv-U’s SSH handling allowed remote code execution and was used by a state-backed group. In 2024 an unauthenticated request could read any file on the server’s disk. Each stayed open on every server until its own team installed the fix.
Every dayInbound port
Your server answers anyone who connects.
Partners reach Serv-U through a port open to the internet, so does every scanner and botnet. Each login attempt lands on a machine inside your network, next to your files.
On SFTP.cloud, partners connect to us. Your network has no inbound port left to find.
How we secure it02What you keep
Your partners keep connecting the way they do today. One thing changes.
Most migrations stall on the partners: nobody wants to ask a hundred companies to change their scripts. You only need to tell them about one thing.
What stays the same
Hostname, accounts, files.
Export your Serv-U users into the SFTP.cloud CSV template and import it, or create accounts through the API. See the CSV template
- Keep your hostname, such as sftp.yourcompany.com, with a DNS record
- Import usernames, passwords and SSH public keys, so nobody resets a password or swaps a key
- Bring home folders, permissions, protocols and allow lists across with each account
- Point your Storage Connector at the disk or share Serv-U uses today. No files move
What changes
The server’s host key.
SFTP clients check a server’s host key on every connection. SFTP.cloud has its own, so partners see a new fingerprint the first time they connect.
- Send partners the new fingerprint before you switch DNS
- Partners who pin host keys in scripts update one value
- Interactive clients ask once, then connect as before
Same address, same login, same files. A new key, announced in advance.
03Migration steps
Six steps, with Serv-U running until the last one.
You run the migration yourself, following our documentation. Nothing is switched off until your partners are already working on SFTP.cloud.
- 01
Start a trial and connect your storage.
Install a Storage Connector next to the disk or share Serv-U writes to today. It only makes outbound connections.
- 02
Import your accounts.
Export users from Serv-U into the SFTP.cloud CSV template: usernames, passwords, SSH public keys, home folders and permissions. Import it in the Portal or through the API.
- 03
Test with one partner.
Run both side by side. Ask a friendly partner to connect to SFTP.cloud directly and confirm uploads land where they did before.
- 04
Announce the new host key.
Send partners the SFTP.cloud host key fingerprint and the date of the switch, so pinned keys are updated in time.
- 05
Switch DNS.
Point your hostname at SFTP.cloud. Partners keep the address and credentials they already use.
- 06
Retire the Serv-U server.
Once traffic has moved, close the inbound port, shut the server down and let the subscription lapse at renewal.
Your partners change one key. You stop running a server.
Not ready to retire Serv-U?
Keep it, and close its inbound port anyway. SFTP.cloud can sit in front of your existing SFTP server as its storage, so partners connect to us and your Serv-U server is no longer reachable from the internet.
04Before you decide
What Serv-U does that SFTP.cloud does not.
SFTP.cloud covers SFTP, FTPS, FTPES and HTTPS. If you use Serv-U for more than that, or are weighing a cheaper Serv-U edition, check these first. Each comes with a trade-off worth weighing.
- 01
Partners on plain FTP or HTTP.
SFTP.cloud does not accept unencrypted FTP or HTTP. Partners on plain FTP move to FTPS or FTPES, which most FTP clients already support, and browser users move to the HTTPS web client. The trade-off is one setting per partner, in exchange for no passwords sent in clear text.
- 02
Dropping to Serv-U FTP Server.
SolarWinds lists the FTP edition from $55 per server per month. The trade-off is that it serves FTP and FTPS only, with no SFTP, and it is still a server you patch and expose, with the same codebase behind the 2026 advisories.
- 03
Serv-U on a cloud VM.
SolarWinds does not offer Serv-U as a hosted service, so the cloud option is installing it on a virtual machine. The trade-off is that you stop owning hardware but still patch Serv-U and the operating system, and the open port moves to a VM you run.
You do not need the Serv-U Gateway either. With no inbound port, there is no DMZ to proxy.
05FAQ
Moving off Serv-U, common questions.
Can I keep my current SFTP hostname?
Yes. Point your existing hostname, such as sftp.yourcompany.com, at SFTP.cloud with a DNS record. Partners keep the address they already use.
Will my partners have to change anything?
Only the host key. SFTP.cloud cannot reuse your Serv-U server’s host key, so partners see a new fingerprint the first time they connect. Send it to them before you switch DNS.
Do partners need new passwords or SSH keys?
No. The SFTP.cloud CSV template carries usernames, passwords, SSH public keys and folder permissions, so partners sign in exactly as before.
Do my files have to move?
No. Your Storage Connector can point at the same disk or network share Serv-U uses today, and files keep landing there.
Does SFTP.cloud store my files?
No. Files stream through the Storage Connector you run next to your storage and are never written to a disk we own. The Connector only makes outbound connections, so there is no inbound rule to your network.
Does SFTP.cloud support plain FTP?
No. SFTP.cloud supports SFTP, FTPS, FTPES and an HTTPS web client. Partners on plain FTP move to FTPS or FTPES. From the SSH family it offers SFTP only, by design: no SCP, shell, SSH commands or tunnels.
Do you migrate it for me?
Migration is self-service and documented step by step. You can run SFTP.cloud alongside Serv-U for as long as you need before switching.
Can I keep Serv-U and just close the inbound port?
Yes. SFTP.cloud can use your existing SFTP server as its storage. Partners connect to SFTP.cloud, which passes files to your Serv-U server over an outbound connection, so the server is no longer exposed to the internet.
Run it next to Serv‑U for fourteen days.
Connect the storage Serv‑U uses, import a few accounts and test with one partner before anything changes. No credit card, and nothing to cancel if it is not for you.
Want the details first? Read about security or SFTP for on-premises storage.