SolarWinds Patches Three Critical Serv-U Vulnerabilities

SolarWinds has issued patches for three critical vulnerabilities in its Serv-U enterprise file transfer solution, all tied to version 15.5.2.2.102 and addressed in the new 15.5.3 release. The flaws include CVE-2025-40549, described as a path restriction bypass that an administrator could abuse to execute arbitrary code on a directory; CVE-2025-40548, a broken access control issue that can be exploited by an admin to run arbitrary code; and CVE-2025-40547, a logic error enabling code execution by an administrator.

SolarWinds notes that the severity for CVE-40547 and CVE-40548 on Windows is medium because services often run under less-privileged accounts. In addition, the company flagged medium-severity vulnerabilities in Observability Self-Hosted, covering open redirection and XSS, which were also patched. The news emphasises that threat actors have historically exploited SolarWinds product vulnerabilities, and SecurityWeek reports the patch release on 20 November 2025, according to SecurityWeek.