SolarWinds Serv-U Access Control Vulnerability
A critical vulnerability affecting SolarWinds Serv-U would allow an attacker to create a system administrator account and execute arbitrary code with privileged rights on affected systems.
Description
Technical context and vulnerability details
SolarWinds Serv-U is an enterprise file transfer solution that offers FTP, FTPS, SFTP and HTTP/S services to exchange data securely. This solution is affected by a critical vulnerability labeled CVE-2025-40538, resulting from insufficient access control in the management of administrative privileges. Exploitation of this vulnerability would allow an authenticated, low-privileged attacker to create a full-privileged system administrator account and execute arbitrary code on affected systems. It is classified critical with a severity score of 9.1 according to CVSS V3.1.
Potential Risks & Impact
Potential consequences upon exploitation
- Data privacy breach;
- Compromise of system integrity;
- Remote Arbitrary Code Execution;
Affected systems
Products, components and targeted versions
- SolarWinds Serv-U versions prior to 15.5.4;
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Update SolarWinds Serv-U to version 15.5.4 or later;
Sources & External Links
Vendor security advisories and documentation
- https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-5-4_release_notes.htm
- https://nvd.nist.gov/vuln/detail/CVE-2025-40538
- https://cyberveille.esante.gouv.fr/alertes/solarwinds-cve-2025-40538-2026-02-25
- https://cvefeed.io/vuln/detail/CVE-2025-40538
- https://www.securityweek.com/solarwinds-patches-four-critical-serv-u-vulnerabilities/
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.