SolarWinds Serv-U fixes 4 critical vulnerabilities

Do you think this report is well-written? *

Yes

Do you use this technology? *

Yes

Was this report useful to you?

Yes

We would be happy if you would describe:

The security services provided by CESNET are designed to provide significant support in ensuring the cybersecurity of connected organizations. Although we strive to provide quality and reliable services, it is not possible to guarantee absolute coverage of all security vulnerabilities. Our services should be seen as a complement to an organization's own security management, not as a replacement. The client bears ultimate responsibility for securing their environment.

This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] SolarWinds Serv-U fixes 4 critical vulnerabilities

SolarWinds version 15.5.4 fixes 4 critical vulnerabilities in Serv-U [1][2][3][4].

SolarWinds Serv-U - RCE (CVE-2025-40538)

CVSS 9.1 (Critical)

Allows an authenticated remote attacker to create a user with system privileges and subsequently, using domain administrator or group administrator privileges, execute arbitrary code with root privileges due to an access control vulnerability [1].

The vulnerability is present in product:

Serv-U; >=15.5, <15.5.4

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

More information:

CVE-2025-40538 at cve.org, NVD
CWE-269: Improper Privilege Management at cwe.mitre.org

The vulnerability was publicly disclosed 24. 2. 2026.

SolarWinds Serv-U - RCE (CVE-2025-40539, CVE-2025-40540)

CVSS 9.1 (Critical)

Allows an authenticated remote attacker with administrator privileges to execute arbitrary native code as root due to a type confusion vulnerability [2][3].

The vulnerability is present in product:

Serv-U; >=15.5, <15.5.4

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

More information:

CVE-2025-40539 at cve.org, NVD
CVE-2025-40540 at cve.org, NVD
CWE-704: Incorrect Type Conversion or Cast at cwe.mitre.org

The vulnerability was publicly disclosed 24. 2. 2026.

SolarWinds Serv-U - RCE (CVE-2025-40541)

CVSS 9.1 (Critical)

Allows an authenticated remote attacker with administrator privileges to execute native code as root due to an IDOR (Insecure Direct Object Reference) vulnerability [4].

The vulnerability is present in product:

Serv-U; >=15.5, <15.5.4

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

More information:

CVE-2025-40541 at cve.org, NVD
CWE-704: Incorrect Type Conversion or Cast at cwe.mitre.org

The vulnerability was publicly disclosed 24. 2. 2026.

Links

By CESNET, z.s.p.o. Michaela Jarošová on 26. 2. 2026.

Report feedback

[TLP:CLEAR] SolarWinds Serv-U fixes 4 critical vulnerabilities

SolarWinds Serv-U - RCE (CVE-2025-40538)

CVSS 9.1 (Critical)

SolarWinds Serv-U - RCE (CVE-2025-40539, CVE-2025-40540)

CVSS 9.1 (Critical)

SolarWinds Serv-U - RCE (CVE-2025-40541)

CVSS 9.1 (Critical)

Links