Loading vulnerability…
Type Confusion RCE in SolarWinds Serv-U
CVE-2025-40539 is a critical type confusion vulnerability in SolarWinds Serv-U, including the Serv-U Web Interface, affecting Serv-U 15.5 and fixed in Serv-U 15.5.4. The flaw can be exploited by an authenticated administrator to trigger arbitrary native code execution in a privileged context. Available reporting characterizes the issue as a type confusion bug leading to privileged code execution as root or another privileged account, but does not provide function-level details about the vulnerable code path.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows arbitrary native code execution with privileged account permissions, including root on affected deployments. This can result in full compromise of the Serv-U host, including installation of persistent malware, execution of follow-on payloads, access to sensitive data handled by the file transfer server, and use of the system as a pivot point for lateral movement. On Windows deployments, impact may be reduced where the service runs under a less-privileged service account by default, but privileged code execution within the service context remains possible.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure of Serv-U administrative interfaces to trusted management networks or VPN-only access, enforce strong administrative access controls including MFA, minimize the privileges of the account under which Serv-U services run, and closely monitor for suspicious administrator activity and signs of post-authentication abuse. These measures only reduce risk and do not eliminate the vulnerability.
Patch, then assume compromise.
Upgrade SolarWinds Serv-U to version 15.5.4 or later. The available information identifies Serv-U 15.5.4 as the vendor release that remediates CVE-2025-40539. Organizations should verify the update has been successfully applied across all Serv-U nodes and components.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
29 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.