Loading story…
SolarWinds Serv-U has been found to contain two critical vulnerabilities, CVE-2025-40548 and CVE-2025-40549, both with a CVSS score of 9.1. These flaws allow authenticated administrators to perform remote code execution and bypass path restrictions, potentially enabling attackers with admin access to execute arbitrary code or access restricted directories. The vulnerabilities are particularly severe on non-Windows deployments, where default service account privileges may not mitigate the risk. Both issues require administrative privileges to exploit, but their impact is considered critical due to the potential for full system compromise.
Security advisories highlight that the vulnerabilities stem from missing validation processes and improper path restriction enforcement within the Serv-U software. While the flaws are not exploitable by unauthenticated users, organizations using SolarWinds Serv-U are urged to review their deployments, especially where admin credentials may be exposed or weakly protected. No specific affected product versions have been listed, but the vulnerabilities have been confirmed by SolarWinds and are publicly documented in multiple security feeds.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Later reporting stated that SolarWinds had addressed three critical vulnerabilities in Serv-U. This marked the vendor response and remediation stage for the disclosed Serv-U security issues.
Subsequent reporting described the SolarWinds Serv-U issues as critical flaws with a CVSS score of 9.1, noting that an authenticated administrator could achieve remote code execution and bypass path restrictions. This added technical characterization of the impact of the disclosed vulnerabilities.
SolarWinds Serv-U vulnerabilities CVE-2025-40548 and CVE-2025-40549 were publicly listed as high-severity issues. The flaws were described as a broken access control remote code execution vulnerability and a path restriction bypass vulnerability affecting Serv-U.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcesecurityonline.info
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SolarWinds disclosed and patched multiple high-severity vulnerabilities in **Serv-U** that can let authenticated attackers take over accounts, escalate privileges, read and write arbitrary files, and in some cases achieve remote code execution as `root`. The issues affect **Serv-U 15.5.4 HF1 and earlier** on both Windows and Linux, with SolarWinds noting the impact is generally more severe on Linux and lower on Windows. The vendor fixed the flaws in **Serv-U 2026.3** and said the vulnerabilities were reported through the **Intigriti** bug bounty program. The disclosed CVEs include broken access control, privilege escalation, and **IDOR** weaknesses such as **`CVE-2026-28321`** for arbitrary file read/write that can be leveraged into code execution, **`CVE-2026-28312`** and **`CVE-2026-28310`** for elevation to system administrator, **`CVE-2026-28309`** for creating system administrator accounts, and **`CVE-2026-28313`**, **`CVE-2026-28314`**, **`CVE-2026-28316`**, and **`CVE-2026-28317`** for account takeover, SMTP hijacking, and further privilege escalation. SolarWinds said the bugs require existing privileges rather than unauthenticated access, but warned that stolen or low-tier credentials could be chained to gain full control of a Serv-U host; no public exploits or confirmed in-the-wild abuse had been reported at disclosure.
Jul 22, 2026
SolarWinds released *Serv-U* 15.5.4 security updates addressing four remote code execution vulnerabilities that can allow execution of arbitrary code as a **privileged (root/admin) account** on affected Windows and Linux servers. The most severe issue, **CVE-2025-40538**, is a **broken access control** flaw that can let an attacker with domain admin or group admin privileges create a system admin user and then execute code with elevated permissions; it is scored `CVSS:3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H` and mapped to **CWE-269**. SolarWinds also fixed **CVE-2025-40539** and **CVE-2025-40540** (both **type confusion** issues, **CWE-704**) and **CVE-2025-40541** (an **IDOR** issue leading to privileged code execution). All four vulnerabilities require **high/administrative privileges** to exploit, which limits standalone exploitation but supports chaining scenarios (e.g., stolen admin credentials or prior privilege escalation). Internet exposure remains a concern: one report cited Shodan identifying **12,000+** exposed Serv-U instances, while Shadowserver estimated **<1,200**.
Jun 29, 2026
SolarWinds disclosed **CVE-2024-28995**, a high-severity directory traversal and local file disclosure flaw in its **Serv-U** managed file transfer software that affects versions earlier than **15.4.2 Hotfix 2**. The vulnerability can be exploited remotely and without authentication via crafted HTTP `GET` requests, allowing attackers to read arbitrary files from the host system, including sensitive material such as credentials, certificates, and configuration data. Rapid7 described the issue as trivially exploitable, and SolarWinds issued fixes through **Serv-U 15.4.2 HF2**, with deployment requiring **15.4.2 HF1** first. Security researchers and national defenders reported that exploitation began quickly after disclosure. GreyNoise observed internet-wide exploitation activity targeting exposed Serv-U instances, while CSIRT.SK warned that public scanning tools and proof-of-concept exploit code were increasing the likelihood of opportunistic attacks. The combination of unauthenticated access, straightforward exploitation, and the ability to extract sensitive files has made patching exposed Serv-U servers an urgent priority.
Jul 23, 2026