This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] SolarWinds fixes 5 vulnerabilities

SolarWinds fixes 5 vulnerabilities in the Serv-U and Observability Self-Hosted products. The most severe ones are described below; the remaining ones can be found in the individual links. Products and their fixed versions: SolarWinds Serv-U - 15.5.3 [1][2][3] SolarWinds Observability Self-Hosted - 2025.4 SR1 [4][5]

SolarWinds Serv-U - RCE (CVE-2025-40547)
CVSS 9.1 (Critical)

Due to a logic error in Serv-U, an authenticated remote attacker with administrator privileges can execute code without authorization. On the Windows platform, the risk is rated as medium because the service does not use administrator privileges by default [1].

The vulnerability is present in product:

  • SolarWinds Serv-U; ==15.5.2.2.102;

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 18. 11. 2025.

SolarWinds Serv-U - RCE (CVE-2025-40548)
CVSS 9.1 (Critical)

Due to insufficient validation on Serv-U, an authenticated remote attacker with administrator privileges can execute code without authorization. On the Windows platform, the risk is rated as medium because the service does not use administrator privileges by default [2].

The vulnerability is present in product:

  • SolarWinds Serv-U; ==15.5.2.2.102;

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 18. 11. 2025.

SolarWinds Serv-U - RCE (CVE-2025-40549)
CVSS 9.1 (Critical)

An authenticated remote attacker with administrator privileges can bypass the path restriction on Serv-U and execute code in a different directory without authorization. On the Windows platform, the risk is rated only as medium due to differences in the handling of paths and home directories [3].

The vulnerability is present in product:

  • SolarWinds Serv-U; ==15.5.2.2.102;

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

More information:

  • CVE-2025-40549 at cve.org, NVD
  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') at cwe.mitre.org

The vulnerability was publicly disclosed 18. 11. 2025.

SolarWinds Observability Self-Hosted - XSS (CVE-2025-26391)
CVSS 5.4 (Medium)

An authenticated attacker on an adjacent network can perform an XSS attack in Observability Self-Hosted [4].

The vulnerability is present in product:

  • SolarWinds Observability Self-Hosted; <=2025.4;

CVSS: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

More information:

  • CVE-2025-26391 at cve.org, NVD
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 18. 11. 2025.

By CESNET, z.s.p.o. Michaela Ručková on 24. 11. 2025.

CESNET, z.s.p.o. Logo