Loading vulnerability…
Broken Access Control RCE in SolarWinds Serv-U
CVE-2025-40538 is a broken access control vulnerability in SolarWinds Serv-U affecting Serv-U 15.5. The flaw allows an attacker who already holds elevated Serv-U administrative privileges, specifically domain admin or group admin privileges within the product, to create a new system administrator account and then execute arbitrary code in a privileged context. Reported impact includes execution as root on affected deployments, or as an equivalent privileged account depending on platform and service configuration. The issue is characterized as improper privilege management arising from insufficient enforcement of authorization boundaries between administrative roles.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an attacker to escalate from existing high-level administrative access within Serv-U to full system-administrator capability inside the application and arbitrary code execution in a privileged operating-system context. This can result in complete compromise of the Serv-U host, including unauthorized administrative account creation, execution of attacker-controlled native code, persistence, access to sensitive transferred or stored data, and use of the server as a pivot point for further intrusion. On Linux this may result in root-level execution; on Windows the practical impact may be reduced where Serv-U services run under less-privileged service accounts by default, though privileged compromise remains possible.
If you can’t patch tonight, do this now.
If immediate patching is not possible, restrict Serv-U administrative access to trusted management paths only, such as internal networks or controlled VPN access, enforce MFA and strong credential controls for all administrative accounts, and apply least-privilege to Serv-U service accounts where supported. Closely monitor for unexpected creation of Serv-U system administrator accounts, anomalous privileged actions, and signs of code execution from the Serv-U host. If compromise is suspected, rotate administrative credentials and perform incident response review of the server and adjacent systems.
Patch, then assume compromise.
Upgrade SolarWinds Serv-U to version 15.5.4, which contains the vendor fix for CVE-2025-40538. Organizations should verify that all Serv-U nodes and components have been updated successfully and that no unsupported or older 15.5 deployments remain in service. After patching, review Serv-U administrative accounts and privileged activity to confirm no unauthorized system administrator accounts were created prior to remediation.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
45 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.