SolarWinds Serv-U Critical Vulnerabilities (CVE-2025-40538–40541) – Patch Now
On February 24, 2026, SolarWinds released Serv-U version 15.5.4 to address four critical remote code execution (RCE) vulnerabilities in its Managed File Transfer software. These flaws, tracked as CVE-2025-40538, CVE-2025-40539, CVE-2025-40540, and CVE-2025-40541, are rated 9.1 CVSS and pose a severe risk to organizations using Serv-U for secure file transfers.
Vulnerability Breakdown
| CVE | Type | Risk | Exploit Requirement | Impact |
|---|---|---|---|---|
| CVE-2025-40538 | Broken Access Control | Critical | Admin privileges (domain/group) | Create system admin → execute arbitrary code as root/SYSTEM |
| CVE-2025-40539 | Type Confusion | Critical | Admin privileges | Execute arbitrary native code as root/SYSTEM |
| CVE-2025-40540 | Type Confusion | Critical | Admin privileges | Execute arbitrary native code as root/SYSTEM |
| CVE-2025-40541 | IDOR | Critical | Admin privileges | Execute arbitrary native code as root/SYSTEM |
Key Note: Exploitation requires administrative privileges, but once leveraged, attackers can achieve operating system-level code execution. On Windows, the risk is somewhat reduced since Serv-U services often run under less‑privileged accounts
Exploitation Context
- No active exploitation reported yet.
- Past Serv-U vulnerabilities (CVE-2021-35211, CVE-2021-35247, CVE-2024-28995) were exploited by Storm-0322, a China-based threat group.
- Serv-U is often deployed as an internet-facing FTP/FTPS/SFTP gateway, making it a high-value target for attackers.
Recommended Security Actions
- Upgrade immediately to Serv-U 15.5.4.
- Audit admin accounts for unauthorized access.
- Restrict privileges to minimize exposure.
- Monitor logs for suspicious activity (e.g., new admin creation).
- Conduct threat hunting for indicators of compromise linked to Storm-0322.
Follow Us On – X.com, Telegram, LinkedIN, Discord Server,
For The Latest Updates, Vulnerability Insights, Security News, Cyberattack Scoops And Cybersecurity Best Practices Delivered Straight To Your Inbox – Subscribe To Our Newsletter
