Loading vulnerability…
Type Confusion RCE in SolarWinds Serv-U
CVE-2025-40540 is a critical type confusion vulnerability in SolarWinds Serv-U, including the Serv-U 15.5 branch. The flaw affects the Serv-U web interface and can be triggered by an attacker who already has administrative access to the product, resulting in arbitrary native code execution in a privileged execution context. On Linux deployments, successful exploitation can lead to code execution as root. On Windows deployments, impact may be reduced where the service runs under a less-privileged service account by default, but the vulnerability still enables execution in the security context of the Serv-U service.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows arbitrary native code execution as the privileged account running Serv-U, which can result in full compromise of the Serv-U host. An attacker could execute system commands, install additional payloads, establish persistence, access or manipulate sensitive transferred data, and use the compromised server as a pivot for lateral movement. Impact is generally highest on Linux systems where the service may run as root; on Windows, severity may be somewhat reduced if the service is configured to run under a restricted service account.
If you can’t patch tonight, do this now.
If immediate patching is not possible, restrict Serv-U administrative access to trusted internal networks or VPN-only management paths, enforce MFA for administrator accounts, minimize the number of users with administrative privileges, and closely monitor for suspicious administrator activity and abnormal Serv-U process behavior. On Windows, ensure the service runs with the least privileges necessary to reduce post-exploitation impact. These measures only reduce exposure and do not eliminate the underlying vulnerability.
Patch, then assume compromise.
Upgrade SolarWinds Serv-U to version 15.5.4 or later, which contains the vendor fix for CVE-2025-40540. Verify that all Serv-U nodes, components, and administrative interfaces in the environment have been updated successfully. If compromise is suspected, perform incident response actions in addition to patching, including review of administrative activity and credential rotation.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
28 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.