Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.2
Serv-U allows a hacker to run malicious code as admin
CVE-2025-40540
Summary
A hacker can exploit a security weakness in Serv-U to run malicious code on your server with administrator privileges. This could allow them to access sensitive data or take control of your server. To protect your system, ensure Serv-U is updated to the latest version and that your server's administrative privileges are properly configured.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions | Fix available |
|---|---|---|---|
| solarwinds | serv-u | <= 15.5.4 | – |
Original title
A type confusion vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to execute arbitrary native code as privileged account.
This issue requires administrative...
Original description
A type confusion vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to execute arbitrary native code as privileged account.
This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a medium because services frequently run under less-privileged service accounts by default.
This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a medium because services frequently run under less-privileged service accounts by default.
nvd CVSS3.1
7.2
Vulnerability type
CWE-704
- https://documentation.solarwinds.com/en/success_center/servu/content/release_not... Release Notes Vendor Advisory
- https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-40540 Vendor Advisory
Published: 24 Feb 2026 · Updated: 12 Mar 2026 · First seen: 6 Mar 2026