Not scored
CVE-2025-40549
SolarWinds Serv-U Path Restriction Bypass Vulnerability
SolarWindsServ-U
Status
- Not in CISA KEV
- Vendor fix available
Exploit probabilityEPSSchecked 25 Oct
1.1%probability of exploitation in the next 30 days
Higher than 66% of scored CVEs
SeverityCVSS
–Not scored yet
Description NVD
A Path Restriction Bypass vulnerability exists in Serv-U that when abused, could give a malicious actor with access to admin privileges the ability to execute code on a directory. This issue requires administrative privileges to abuse. On Windows systems, this scored as medium due to differences in how paths and home directories are handled.
Coverage 1 article · 1 outlet
- SolarWinds fixes four Serv U file server bugs that allow rootSecurity Affairs · first in our coverage · mentions it in passing