Not scored
CVE-2025-40541
SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Remote Code Execution Vulnerability
SolarWindsServ-U
Status
- Not in CISA KEV
- Vendor fix available
Exploit probabilityEPSSchecked 25 Oct
0.6%probability of exploitation in the next 30 days
Higher than 48% of scored CVEs
SeverityCVSS
–Not scored yet
Description NVD
An Insecure Direct Object Reference (IDOR) vulnerability exists in Serv-U, which when exploited, gives a malicious actor the ability to execute native code as a privileged account. This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a medium because services frequently run under less-privileged service accounts by default.
Coverage 3 articles · 3 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Tue 24 Feb · 21:01 UTC | Security Affairs | SolarWinds fixes four Serv U file server bugs that allow root |
| Wed 25 Feb · 08:56 UTC | The Hacker News | SolarWinds fixes Serv U file transfer RCE flaws needing admin |
| Wed 25 Feb · 15:36 UTC | SecurityWeek | SolarWinds patches four ServU file transfer RCEs, update to 15.5.4 |
- SolarWinds patches four ServU file transfer RCEs, update to 15.5.4SecurityWeek · mentions it in passing
- SolarWinds fixes Serv U file transfer RCE flaws needing adminThe Hacker News · mentions it in passing
- SolarWinds fixes four Serv U file server bugs that allow rootSecurity Affairs · first in our coverage · mentions it in passing