Loading story…
SolarWinds released Serv-U 15.5.4 security updates addressing four remote code execution vulnerabilities that can allow execution of arbitrary code as a privileged (root/admin) account on affected Windows and Linux servers. The most severe issue, CVE-2025-40538, is a broken access control flaw that can let an attacker with domain admin or group admin privileges create a system admin user and then execute code with elevated permissions; it is scored CVSS:3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H and mapped to CWE-269.
SolarWinds also fixed CVE-2025-40539 and CVE-2025-40540 (both type confusion issues, CWE-704) and CVE-2025-40541 (an IDOR issue leading to privileged code execution). All four vulnerabilities require high/administrative privileges to exploit, which limits standalone exploitation but supports chaining scenarios (e.g., stolen admin credentials or prior privilege escalation). Internet exposure remains a concern: one report cited Shodan identifying 12,000+ exposed Serv-U instances, while Shadowserver estimated <1,200.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Belgium's Centre for Cybersecurity published a warning that critical SolarWinds Serv-U server vulnerabilities could be exploited for remote code execution and urged immediate patching. The notice amplified the vendor's remediation guidance following the disclosure.
The Canadian Centre for Cyber Security published advisory AV26-165 highlighting SolarWinds' Serv-U vulnerabilities, especially CVE-2025-40538, and urged administrators to review the vendor guidance and apply updates. The advisory covered critical issues affecting versions before 15.5.4.
In its disclosure of the four Serv-U vulnerabilities, SolarWinds stated it had not observed exploitation of these newly disclosed flaws in the wild. Multiple reports also noted the issues were not listed in CISA's KEV catalog at the time of disclosure.
SolarWinds published Serv-U version 15.5.4 and associated security advisories to fix four critical vulnerabilities affecting versions prior to 15.5.4. The flaws can enable creation of a system administrator account or arbitrary native code execution with elevated privileges, though exploitation requires administrative access.
SolarWinds PSIRT recorded four critical Serv-U vulnerabilities—CVE-2025-40538, CVE-2025-40539, CVE-2025-40540, and CVE-2025-40541. The CVE records indicate the issues were received on this date and involve broken access control, type confusion, and IDOR flaws that can lead to privileged code execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
14 references tracked. Mallory keeps watching after this page renders.
secpod.com
Open sourcesocradar.io
Open sourcecybersecuritynews.com
Open sourcethehackernews.com
Open sourcebleepingcomputer.com
Open sourcecvefeed.io
Open sourcego.theregister.com
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SolarWinds disclosed and patched multiple high-severity vulnerabilities in **Serv-U** that can let authenticated attackers take over accounts, escalate privileges, read and write arbitrary files, and in some cases achieve remote code execution as `root`. The issues affect **Serv-U 15.5.4 HF1 and earlier** on both Windows and Linux, with SolarWinds noting the impact is generally more severe on Linux and lower on Windows. The vendor fixed the flaws in **Serv-U 2026.3** and said the vulnerabilities were reported through the **Intigriti** bug bounty program. The disclosed CVEs include broken access control, privilege escalation, and **IDOR** weaknesses such as **`CVE-2026-28321`** for arbitrary file read/write that can be leveraged into code execution, **`CVE-2026-28312`** and **`CVE-2026-28310`** for elevation to system administrator, **`CVE-2026-28309`** for creating system administrator accounts, and **`CVE-2026-28313`**, **`CVE-2026-28314`**, **`CVE-2026-28316`**, and **`CVE-2026-28317`** for account takeover, SMTP hijacking, and further privilege escalation. SolarWinds said the bugs require existing privileges rather than unauthenticated access, but warned that stolen or low-tier credentials could be chained to gain full control of a Serv-U host; no public exploits or confirmed in-the-wild abuse had been reported at disclosure.
Jul 22, 2026
SolarWinds Serv-U has been found to contain two critical vulnerabilities, CVE-2025-40548 and CVE-2025-40549, both with a CVSS score of 9.1. These flaws allow authenticated administrators to perform remote code execution and bypass path restrictions, potentially enabling attackers with admin access to execute arbitrary code or access restricted directories. The vulnerabilities are particularly severe on non-Windows deployments, where default service account privileges may not mitigate the risk. Both issues require administrative privileges to exploit, but their impact is considered critical due to the potential for full system compromise. Security advisories highlight that the vulnerabilities stem from missing validation processes and improper path restriction enforcement within the Serv-U software. While the flaws are not exploitable by unauthenticated users, organizations using SolarWinds Serv-U are urged to review their deployments, especially where admin credentials may be exposed or weakly protected. No specific affected product versions have been listed, but the vulnerabilities have been confirmed by SolarWinds and are publicly documented in multiple security feeds.
Jun 29, 2026
CISA warned that attackers are actively exploiting **SolarWinds Serv-U** vulnerability `CVE-2026-28318`, a recently patched high-severity denial-of-service flaw in the company's managed file transfer and FTP server software for **Windows and Linux**. The bug can be triggered through low-complexity, unauthenticated `POST` requests—reported to include the `Content-Encoding: deflate` header—causing the Serv-U service to crash through uncontrolled resource consumption. CISA has added the issue to its **Known Exploited Vulnerabilities** catalog and directed Federal Civilian Executive Branch agencies to remediate by **June 19** under Binding Operational Directive 22-01. SolarWinds said the flaw is fixed in **Serv-U 15.5.4 Hotfix 1**, while CISA urged private-sector organizations to apply mitigations immediately or discontinue use if mitigations are unavailable. Reporting also noted that thousands of Serv-U servers remain exposed online, expanding the potential attack surface. The warning comes amid a broader pattern of SolarWinds Serv-U exploitation, with earlier campaigns tied to the **Clop** ransomware gang, **DEV-0322** Chinese threat actors, and abuse of prior Serv-U vulnerabilities.
Jun 29, 2026