Summary : SolarWinds has fixed four critical vulnerabilities in its popular Serv-U file transfer solution, which is used by businesses and organizations of all sizes. vulnerabilities impact SolarWinds Serv-U Managed File Transfer, a platform frequently deployed as an internet-facing FTP/FTPS/SFTP gateway or as an internal file exchange service handling sensitive data.

OEM	SolarWinds
Severity	Critical
CVSS Score	9.1
CVEs	CVE-2025-40538, CVE-2025-40539, CVE-2025-40540, CVE-2025-40541
POC Available	No
Actively Exploited	No
Exploited in Wild	No
Advisory Version	1.0

Overview 

SolarWinds stated that there are no confirmed reports of active exploitation at this time. However, given previous Serv-U vulnerabilities were exploited by advanced threat actors. 

SolarWinds Serv-U

is a secure file transfer server used by organizations to manage FTP, FTPS, SFTP, and HTTP/S file transfers across enterprise environments. It is commonly deployed on Windows and Linux servers to securely exchange sensitive business data. 

SolarWinds fixed four critical remote code execution vulnerabilities in Serv-U 15.5. These vulnerabilities could allow an attacker with administrative privileges to execute arbitrary native code as root on the affected server. 

Vulnerability Name	CVE ID	Product Affected	Severity	CVSS Score	Fixed Version
Broken Access Control Remote Code Execution Vulnerability	CVE-2025-40538	Serv-U	Critical	9.1	Serv-U 15.5.4
Type Confusion Remote Code Execution Vulnerability	CVE-2025-40539	Serv-U	Critical	9.1	Serv-U 15.5.4
Type Confusion Remote Code Execution Vulnerability	CVE-2025-40540	Serv-U	Critical	9.1	Serv-U 15.5.4
Insecure Direct Object Reference (IDOR) Remote Code Execution Vulnerability	CVE-2025-40541	Serv-U	Critical	9.1	Serv-U 15.5.4

Technical Summary 

These critical vulnerabilities affect SolarWinds Serv-U version 15.5 and arise from weaknesses such as improper access control checks, type confusion errors, and insecure object reference handling.

If exploited, they may allow an attacker to run arbitrary native code with root-level privileges on the affected server. 

Successful exploitation requires administrative access. Once obtained, an attacker could create unauthorized administrator accounts, and execute malicious code, potentially resulting in complete system compromise and further movement across the network.

SolarWinds strongly advises upgrading to Serv-U version 15.5.4 to address these security risks. 

CVE ID	System Affected	Vulnerability Details	Impact
CVE-2025-40538	Serv-U 15.5	Improper access control enabling admin creation and root-level code execution	Admin account creation, full system compromise
CVE-2025-40539	Serv-U 15.5	Type confusion enabling arbitrary native code execution as root	Arbitrary native code execution
CVE-2025-40540	Serv-U 15.5	Type confusion leading to root-level native code execution	Root-level execution
CVE-2025-40541	Serv-U 15.5	IDOR enabling unauthorized access and root-level code execution	Remote code execution as root

Potential Consequences 

• Full server takeover 

• Privilege escalation 

• Lateral movement within enterprise network 

• Data exfiltration 

• Malware or backdoor deployment 

Remediation:  

Upgrade immediately to Serv-U product with below mentioning fixed version- 

• Serv-U 15.5.4  

If immediate patching is not possible, apply the following temporary mitigations- 

1. Restrict Serv-U administrative access to trusted IP ranges. 

2. Enforce MFA for all Serv-U admin accounts. 

3. Ensure services run with least privilege. 

4. Conduct audit of newly created administrative accounts. 

You can follow the recommendations below as a best practice- 

• Enforce strict administrative access controls. 

• Monitor logs for unauthorized privilege escalation. 

• Implement network segmentation for file transfer servers. 

• Apply regular patch management and vulnerability scanning. 

Conclusion: 
These four newly disclosed vulnerabilities in SolarWinds Serv-U represent critical remote code execution risks. Although exploitation has not been confirmed, Serv-U’s history of targeted attacks increases the urgency for patching. 

Organizations should treat this as a priority patching event and immediately upgrade to Serv-U 15.5.4 to prevent potential root-level compromise. 

References:  

• Serv-U 15.5.4 release notes 

• SolarWinds Patches 4 Critical Serv-U 15.5 Flaws Allowing Root Code Execution