Not scored
CVE-2025-40548
SolarWinds Serv-U Broken Access Control - Remote Code Execution Vulnerability
SolarWindsServ-U
Status
- Not in CISA KEV
- Vendor fix available
Exploit probabilityEPSSchecked 25 Oct
0.8%probability of exploitation in the next 30 days
Higher than 55% of scored CVEs
SeverityCVSS
–Not scored yet
Description NVD
A missing validation process exists in Serv U when abused, could give a malicious actor with access to admin privileges the ability to execute code. This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a medium because services frequently run under less-privileged service accounts by default.
Coverage 1 article · 1 outlet
- SolarWinds fixes four Serv U file server bugs that allow rootSecurity Affairs · first in our coverage · mentions it in passing