internet-facing-service-vulnerabilitywidely-deployed-product-advisoryprivilege-escalation-methodinternet-exposed-service

SolarWinds Serv-U Patches Four Privileged RCE Flaws Enabling Root/Admin Code Execution

Vulnerability Disclosure · 14 sources · Updated 4mo ago · First seen Feb 24, 2026

SolarWinds released Serv-U 15.5.4 security updates addressing four remote code execution vulnerabilities that can allow execution of arbitrary code as a privileged (root/admin) account on affected Windows and Linux servers. The most severe issue, CVE-2025-40538, is a broken access control flaw that can let an attacker with domain admin or group admin privileges create a system admin user and then execute code with elevated permissions; it is scored CVSS:3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H and mapped to CWE-269.

SolarWinds also fixed CVE-2025-40539 and CVE-2025-40540 (both type confusion issues, CWE-704) and CVE-2025-40541 (an IDOR issue leading to privileged code execution). All four vulnerabilities require high/administrative privileges to exploit, which limits standalone exploitation but supports chaining scenarios (e.g., stolen admin credentials or prior privilege escalation). Internet exposure remains a concern: one report cited Shodan identifying 12,000+ exposed Serv-U instances, while Shadowserver estimated <1,200.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

5 events · Feb 24, 2026 – Feb 25, 2026

Feb 25, 20268mo ago
Belgium CCB warns users to patch critical Serv-U vulnerabilities
Belgium's Centre for Cybersecurity published a warning that critical SolarWinds Serv-U server vulnerabilities could be exploited for remote code execution and urged immediate patching. The notice amplified the vendor's remediation guidance following the disclosure.
Feb 24, 20268mo ago
Canadian Centre for Cyber Security issues advisory on Serv-U flaws
The Canadian Centre for Cyber Security published advisory AV26-165 highlighting SolarWinds' Serv-U vulnerabilities, especially CVE-2025-40538, and urged administrators to review the vendor guidance and apply updates. The advisory covered critical issues affecting versions before 15.5.4.
Feb 24, 20268mo ago
SolarWinds says no in-the-wild exploitation has been observed
In its disclosure of the four Serv-U vulnerabilities, SolarWinds stated it had not observed exploitation of these newly disclosed flaws in the wild. Multiple reports also noted the issues were not listed in CISA's KEV catalog at the time of disclosure.
Feb 24, 20268mo ago
SolarWinds releases Serv-U 15.5.4 to patch four critical flaws
SolarWinds published Serv-U version 15.5.4 and associated security advisories to fix four critical vulnerabilities affecting versions prior to 15.5.4. The flaws can enable creation of a system administrator account or arbitrary native code execution with elevated privileges, though exploitation requires administrative access.
Feb 24, 20268mo ago
SolarWinds PSIRT receives four Serv-U vulnerability reports
SolarWinds PSIRT recorded four critical Serv-U vulnerabilities—CVE-2025-40538, CVE-2025-40539, CVE-2025-40540, and CVE-2025-40541. The CVE records indicate the issues were received on this date and involve broken access control, type confusion, and IDOR flaws that can lead to privileged code execution.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

4 linked

Type Confusion RCE in SolarWinds Serv-U (CVE-2025-40540)Broken Access Control RCE in SolarWinds Serv-U (CVE-2025-40538)Type Confusion RCE in SolarWinds Serv-U (CVE-2025-40539)SolarWinds Serv-U IDOR Privileged Native Code Execution (CVE-2025-40541)

Affected products

6 linked

Serv-U File ServerServ-U Ftp-ServerServ-UServ-UServ-U Ftp-ServerServ-U Mft

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

14 references tracked. Mallory keeps watching after this page renders.

Secpod BlogNews · Feb 26, 2026

Serv-U Vulnerabilities Expose Systems to Root Compromise - SecPod BlogOpen source ↗

Socradar BlogNews · Feb 25, 2026

SolarWinds Serv-U 15.5.4 Fixes Four Privileged RCE VulnerabilitiesOpen source ↗

Cyber Security NewsNews · Feb 25, 2026

SolarWinds Critical Serv-U Vulnerabilities Enables Root AccessOpen source ↗

The Hacker NewsNews · Feb 25, 2026

SolarWinds Patches 4 Critical Serv-U 15.5 Flaws Allowing Root Code ExecutionOpen source ↗

6 additional sources from 24-02-2026 to 25-02-2026

Bleeping ComputerNews · Feb 24, 2026

Critical SolarWinds Serv-U flaws offer root access to serversOpen source ↗

Cvefeed High SeverityAdvisories · Feb 24, 2026

CVE-2025-40539 - SolarWinds Serv-U Type Confusion Remote Code Execution VulnerabilityOpen source ↗

Patch these 4 critical, make-me-root SolarWinds bugs ASAP • The RegisterOpen source ↗

Cvefeed High SeverityAdvisories · Feb 24, 2026

CVE-2025-40538 - SolarWinds Serv-U Broken Access Control Remote Code Execution VulnerabilityOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

SolarWinds Serv-U Patches Four Privileged RCE Flaws Enabling Root/Admin Code Execution

How this story unfolded

Belgium CCB warns users to patch critical Serv-U vulnerabilities

Canadian Centre for Cyber Security issues advisory on Serv-U flaws

SolarWinds says no in-the-wild exploitation has been observed

SolarWinds releases Serv-U 15.5.4 to patch four critical flaws

SolarWinds PSIRT receives four Serv-U vulnerability reports

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

SolarWinds Serv-U Flaws Allow Account Takeover, Privilege Escalation, and RCE

Critical SolarWinds Serv-U Remote Code Execution and Path Bypass Vulnerabilities

SolarWinds Serv-U Zero-Day Enabled Targeted SSH-Based Remote Code Execution

SolarWinds Serv-U Patches Four Privileged RCE Flaws Enabling Root/Admin Code Execution

How this story unfolded

Belgium CCB warns users to patch critical Serv-U vulnerabilities

Canadian Centre for Cyber Security issues advisory on Serv-U flaws

SolarWinds says no in-the-wild exploitation has been observed

SolarWinds releases Serv-U 15.5.4 to patch four critical flaws

SolarWinds PSIRT receives four Serv-U vulnerability reports

Related entities

Vulnerabilities

Affected products

Sources

See the full picture, correlated to your attack surface.

Related stories

SolarWinds Serv-U Flaws Allow Account Takeover, Privilege Escalation, and RCE

Critical SolarWinds Serv-U Remote Code Execution and Path Bypass Vulnerabilities

SolarWinds Serv-U Zero-Day Enabled Targeted SSH-Based Remote Code Execution