CVE-2025-40538
Broken Access Control in Serv-U Allows Privileged Code Execution
Publication date: 2026-02-24
Last updated on: 2026-02-24
Assigner: SolarWinds
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| solarwinds | serv-u | to 15.5.4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-269 | The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-40538 is a critical broken access control vulnerability in SolarWinds Serv-U. It allows an attacker who already has domain admin or group admin privileges to exploit the broken access control mechanisms to create a new system administrator user account. Additionally, the attacker can execute arbitrary code with root-level (privileged) access on the affected system.
How can this vulnerability impact me? :
If exploited, this vulnerability can allow a malicious actor with certain administrative privileges to escalate their access by creating a system administrator account and executing arbitrary code with the highest level of privileges. This can lead to full system compromise, unauthorized control, and potential disruption or manipulation of critical services.
On Windows deployments, the risk is considered medium because services often run under less-privileged accounts by default, which may limit the impact somewhat.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate CVE-2025-40538, you should update SolarWinds Serv-U to version 15.5.4 or later, as this release addresses and fixes the broken access control vulnerability allowing remote code execution.
Since the vulnerability requires administrative privileges to exploit, ensure that administrative access is tightly controlled and monitored to reduce risk.