BaseFortify

Publication date: 2025-11-18

Last updated on: 2025-12-02

Assigner: SolarWinds

Description

A missing validation process exists in Serv U when abused, could give a malicious actor with access to admin privileges the ability to execute code. This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a medium because services frequently run under less-privileged service accounts by default.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-18

Last Modified

2025-12-02

Generated

2026-07-06

AI Q&A

2025-11-18

EPSS Evaluated

2026-07-05

NVD

CVE-2025-40548

Affected Vendors & Products

Vendor	Product	Version / Range
solarwinds	serv-u	to 15.5.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This vulnerability in Serv U is due to a missing validation process that, when exploited by someone with administrative privileges, allows them to execute arbitrary code on the system.

Impact Analysis

If exploited, this vulnerability can allow an attacker with admin privileges to execute code, potentially leading to full system compromise, including confidentiality, integrity, and availability impacts. On Windows, the risk is considered medium because services often run with less-privileged accounts by default.

Hi! I’m here to help you understand CVE-2025-40548. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70