CVE-2025-40538

Published Feb 24, 2026

Last updated 2 months ago

Serv-U

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-40538 is a broken access control vulnerability identified in SolarWinds Serv-U, a file transfer software. This flaw allows an attacker to create a system administrator user and subsequently execute arbitrary code with elevated privileges. Specifically, this can lead to root-level access on Linux systems or administrative privileges on Windows deployments. Exploitation of this vulnerability requires the attacker to already possess administrative privileges on the targeted server. Once exploited, the attacker can leverage domain or group admin privileges to achieve their objectives.

Description: A broken access control vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to create a system admin user and execute arbitrary code as a privileged account via domain admin or group admin privileges. This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a medium because services frequently run under less-privileged service accounts by default.
Source: psirt@solarwinds.com
NVD status: Analyzed
Products: serv-u

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.2
Impact score: 5.9
Exploitability score: 1.2
Vector string: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

psirt@solarwinds.com: CWE-269

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:solarwinds:serv-u:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "0879DDA2-3F57-41C7-A689-4B904310687E",
            "versionEndExcluding": "15.5.4",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.