Loading story…
SolarWinds disclosed and patched multiple high-severity vulnerabilities in Serv-U that can let authenticated attackers take over accounts, escalate privileges, read and write arbitrary files, and in some cases achieve remote code execution as root. The issues affect Serv-U 15.5.4 HF1 and earlier on both Windows and Linux, with SolarWinds noting the impact is generally more severe on Linux and lower on Windows. The vendor fixed the flaws in Serv-U 2026.3 and said the vulnerabilities were reported through the Intigriti bug bounty program.
The disclosed CVEs include broken access control, privilege escalation, and IDOR weaknesses such as CVE-2026-28321 for arbitrary file read/write that can be leveraged into code execution, CVE-2026-28312 and CVE-2026-28310 for elevation to system administrator, CVE-2026-28309 for creating system administrator accounts, and CVE-2026-28313, CVE-2026-28314, CVE-2026-28316, and CVE-2026-28317 for account takeover, SMTP hijacking, and further privilege escalation. SolarWinds said the bugs require existing privileges rather than unauthenticated access, but warned that stolen or low-tier credentials could be chained to gain full control of a Serv-U host; no public exploits or confirmed in-the-wild abuse had been reported at disclosure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
SolarWinds PSIRT received at least some of the newly disclosed Serv-U vulnerability reports on 2026-07-21, including CVE-2026-28309 and CVE-2026-28316. These reports covered privilege escalation and access control issues affecting Serv-U 15.5.4 HF1 and earlier.
On 2026-07-21, SolarWinds disclosed and remediated multiple high-severity Serv-U vulnerabilities affecting version 15.5.4 HF1 and earlier, releasing fixes in Serv-U 2026.3. The issues included privilege escalation, broken access control, and IDOR flaws, with Linux systems facing the highest impact and no public exploitation reported at disclosure time.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
12 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecyber.gc.ca
Open sourcesecurityonline.info
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcesolarwinds.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SolarWinds released *Serv-U* 15.5.4 security updates addressing four remote code execution vulnerabilities that can allow execution of arbitrary code as a **privileged (root/admin) account** on affected Windows and Linux servers. The most severe issue, **CVE-2025-40538**, is a **broken access control** flaw that can let an attacker with domain admin or group admin privileges create a system admin user and then execute code with elevated permissions; it is scored `CVSS:3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H` and mapped to **CWE-269**. SolarWinds also fixed **CVE-2025-40539** and **CVE-2025-40540** (both **type confusion** issues, **CWE-704**) and **CVE-2025-40541** (an **IDOR** issue leading to privileged code execution). All four vulnerabilities require **high/administrative privileges** to exploit, which limits standalone exploitation but supports chaining scenarios (e.g., stolen admin credentials or prior privilege escalation). Internet exposure remains a concern: one report cited Shodan identifying **12,000+** exposed Serv-U instances, while Shadowserver estimated **<1,200**.
Jun 29, 2026
SolarWinds Serv-U has been found to contain two critical vulnerabilities, CVE-2025-40548 and CVE-2025-40549, both with a CVSS score of 9.1. These flaws allow authenticated administrators to perform remote code execution and bypass path restrictions, potentially enabling attackers with admin access to execute arbitrary code or access restricted directories. The vulnerabilities are particularly severe on non-Windows deployments, where default service account privileges may not mitigate the risk. Both issues require administrative privileges to exploit, but their impact is considered critical due to the potential for full system compromise. Security advisories highlight that the vulnerabilities stem from missing validation processes and improper path restriction enforcement within the Serv-U software. While the flaws are not exploitable by unauthenticated users, organizations using SolarWinds Serv-U are urged to review their deployments, especially where admin credentials may be exposed or weakly protected. No specific affected product versions have been listed, but the vulnerabilities have been confirmed by SolarWinds and are publicly documented in multiple security feeds.
Jun 29, 2026
SolarWinds disclosed **CVE-2024-28995**, a high-severity directory traversal and local file disclosure flaw in its **Serv-U** managed file transfer software that affects versions earlier than **15.4.2 Hotfix 2**. The vulnerability can be exploited remotely and without authentication via crafted HTTP `GET` requests, allowing attackers to read arbitrary files from the host system, including sensitive material such as credentials, certificates, and configuration data. Rapid7 described the issue as trivially exploitable, and SolarWinds issued fixes through **Serv-U 15.4.2 HF2**, with deployment requiring **15.4.2 HF1** first. Security researchers and national defenders reported that exploitation began quickly after disclosure. GreyNoise observed internet-wide exploitation activity targeting exposed Serv-U instances, while CSIRT.SK warned that public scanning tools and proof-of-concept exploit code were increasing the likelihood of opportunistic attacks. The combination of unauthenticated access, straightforward exploitation, and the ability to extract sensitive files has made patching exposed Serv-U servers an urgent priority.
Jul 23, 2026