Not scored
CVE-2025-40538
SolarWinds Serv-U Broken Access Control Remote Code Execution Vulnerability
SolarWindsServ-U
Status
- Not in CISA KEV
- Vendor fix available
Exploit probabilityEPSSchecked 25 Oct
0.5%probability of exploitation in the next 30 days
Higher than 45% of scored CVEs
SeverityCVSS
–Not scored yet
Description NVD
A broken access control vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to create a system admin user and execute arbitrary code as a privileged account via domain admin or group admin privileges. This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a medium because services frequently run under less-privileged service accounts by default.
Coverage 3 articles · 3 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Tue 24 Feb · 21:01 UTC | Security Affairs | SolarWinds fixes four Serv U file server bugs that allow root |
| Wed 25 Feb · 08:56 UTC | The Hacker News | SolarWinds fixes Serv U file transfer RCE flaws needing admin |
| Wed 25 Feb · 15:36 UTC | SecurityWeek | SolarWinds patches four ServU file transfer RCEs, update to 15.5.4 |
- SolarWinds patches four ServU file transfer RCEs, update to 15.5.4SecurityWeek
- SolarWinds fixes Serv U file transfer RCE flaws needing adminThe Hacker News
- SolarWinds fixes four Serv U file server bugs that allow rootSecurity Affairs · first in our coverage