SolarWinds addressed three critical flaws in Serv-U

SolarWinds patched three critical vulnerabilities in its Serv-U file transfer solution that could allow remote code execution. The flaws are CVE-2025-40549 (CVSS 9.1), a path restriction bypass that a user with admin privileges could abuse to run code on a directory, according to SolarWinds advisory, and CVE-2025-40548 (CVSS 9.1), a broken access control where a malicious actor with admin privileges could execute code.

A third flaw, CVE-2025-40547 (CVSS 9.1), is a logic error that could be exploited to execute arbitrary code by an admin. SolarWinds noted that CVE-2025-40547 and CVE-2025-40548 carry only medium severity on Windows because services typically run under low-privileged accounts. The vulnerabilities affect Serv-U 15.5.2.2.102, and a fixed version, 15.5.3., was released to address them.