Executive Summary

CVE-2025-40538 is a critical broken access control vulnerability in SolarWinds Serv-U. It allows an attacker who already has domain admin or group admin privileges to exploit the broken access control mechanisms to create a new system administrator user account. Additionally, the attacker can execute arbitrary code with root-level (privileged) access on the affected system.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability can allow a malicious actor with certain administrative privileges to escalate their access by creating a system administrator account and executing arbitrary code with the highest level of privileges. This can lead to full system compromise, unauthorized control, and potential disruption or manipulation of critical services.

On Windows deployments, the risk is considered medium because services often run under less-privileged accounts by default, which may limit the impact somewhat.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

I don't know

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate CVE-2025-40538, you should update SolarWinds Serv-U to version 15.5.4 or later, as this release addresses and fixes the broken access control vulnerability allowing remote code execution.

Since the vulnerability requires administrative privileges to exploit, ensure that administrative access is tightly controlled and monitored to reduce risk.

Useful 0 Not Useful 0