VulnSocial
← Back to blog

CVE-2025-40538 – High Severity Broken Access Control in SolarWinds Serv‑U

Key Takeaways

  • Severity: High (NIST CVSS 7.2, Vendor CVSS 9.1)
  • Impact: Remote code execution (RCE) with ability to create a system‑admin user and execute arbitrary code as root/privileged.
  • Affected: All SolarWinds Serv‑U installations prior to version 15.5.4.
  • Remediation: Apply the official patch (Serv‑U 15.5.4) immediately and enforce least‑privilege service accounts.

Overview

In late February 2026, SolarWinds disclosed four critical vulnerabilities in its long‑standing file‑transfer server Serv‑U. CVE-2025-40538 is the most severe of the set, granting an attacker with administrative credentials the ability to create a new system‑admin user and execute arbitrary code with root privileges. The flaw is classified as a broken access‑control issue (CWE‑269) and can be exploited over the network (AV:N) with low attack complexity (AC:L).

Technical Details

  • Vulnerability type: Broken access control (privilege escalation).
  • CWE: CWE‑269 – Improper Privilege Management.
  • Prerequisite: The attacker must already possess a domain‑admin or group‑admin account on the target system.
  • Attack flow:
    1. Leverage the vulnerable Serv‑U API to create a new local user with administrative rights.
    2. Use the newly created account to run arbitrary binaries or scripts as the root (or SYSTEM) user.
  • Platform impact: On Windows deployments the service often runs under a low‑privilege account, reducing the immediate impact to Medium in the vendor’s scoring, but the underlying privilege escalation remains Critical when the service runs with elevated rights.

Severity & CVSS

MetricValue
CVSS (NIST)7.2 (High)
Vector (NIST)CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS (Vendor)9.1 (Critical)
Vector (Vendor)CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CWECWE‑269 – Improper Privilege Management

Affected Products

VendorProductFixed Version
SolarWindsServ‑U15.5.4 (or later)
NoteAll prior releases are vulnerable. For the exhaustive list, see the VulnSocial CVE page.

Impact Assessment

ImpactLevel
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh

The combination of confidentiality, integrity, and availability impacts makes the vulnerability a classic RCE scenario that can lead to full system compromise.

Exploitation Timeline

DateEvent
2026‑02‑24Public disclosure of four critical Serv‑U flaws, including CVE-2025-40538; official patch (15.5.4) released.
2026‑02‑25First reports of active exploitation for related CVEs; security community urges immediate patch adoption.
2026‑02‑26Follow‑up mentions; no new PoC or exploit code published.
2026‑02‑27Additional advisory notes stressing urgent remediation.
2026‑02‑28Continued monitoring; no confirmed exploitation of CVE-2025-40538.
2026‑03‑01General discussion and threat‑intel sharing; no new technical details.
2026‑03‑04Final reminder to apply the patch and verify version.

For real‑time threat activity, consult VulnSocial or the dedicated CVE page.

Remediation & Mitigation

  1. Identify the installed version 
    serv-u --version
  2. Download the official patch (Serv‑U 15.5.4) from the SolarWinds security advisory.
  3. Apply the update – example for RPM‑based systems: 
    yum install serv-u-15.5.4
    (or the equivalent apt-get command on Debian‑based platforms).
  4. Restart the Serv‑U service to load the patched binaries.
  5. Validate the update – re‑run serv-u --version and confirm the version is ≥ 15.5.4.
  6. Enforce least‑privilege – configure the Serv‑U service to run under a non‑admin account where possible.
  7. Monitor for suspicious activity – watch for new admin‑account creations or unexpected processes. Real‑time alerts can be sourced from VulnSocial.

Bottom Line

CVE-2025-40538 is a High‑severity broken access‑control flaw in SolarWinds Serv‑U that enables remote code execution with root privileges. The risk is mitigated by applying the official patch (version 15.5.4) and tightening service account permissions. Prompt action is essential to prevent potential full‑system compromise.

References