Critical SolarWinds Serv-U Flaws (CVSS 9.1) Allow Authenticated Admin RCE and Path Bypass

SolarWinds has released security updates addressing three critical vulnerabilities in Serv-U, each with a CVSS score of 9.1 and enabling remote code execution when abused by an authenticated administrator. The flaws, CVE-2025-40547, CVE-2025-40548 and CVE-2025-40549, affect Serv-U prior to version 15.5.3, with Windows deployments sometimes shown as lower impact due to privilege separation and path handling.

According to SolarWinds, the first flaw stemmed from a logic error that could let a malicious actor with admin privileges execute code, the second from missing validation in the authorization logic, and the third from a path restriction bypass that could allow code execution in unauthorized directories.

SolarWinds credits Maurice Moss for reporting the flaw and urges customers using Serv-U FTP Server or Serv-U Managed File Transfer Server to upgrade immediately to version 15.5.3, after which all three vulnerabilities are fully patched.