RCE

SolarWinds Serv-U15.5.4 Rocked by Critical RCE Vulnerabilities; Patch Now

Summary : SolarWinds has fixed four critical vulnerabilities in its popular Serv-U file transfer solution, which is used by businesses and organizations of all sizes. vulnerabilities impact SolarWinds Serv-U Managed File Transfer, a platform frequently deployed as an internet-facing FTP/FTPS/SFTP gateway or as an internal file exchange service handling sensitive data.

OEM	SolarWinds
Severity	Critical
CVSS Score	9.1
CVEs	CVE-2025-40538, CVE-2025-40539, CVE-2025-40540, CVE-2025-40541
POC Available	No
Actively Exploited	No
Exploited in Wild	No
Advisory Version	1.0

Overview

SolarWinds stated that there are no confirmed reports of active exploitation at this time. However, given previous Serv-U vulnerabilities were exploited by advanced threat actors.

SolarWinds Serv-U

is a secure file transfer server used by organizations to manage FTP, FTPS, SFTP, and HTTP/S file transfers across enterprise environments. It is commonly deployed on Windows and Linux servers to securely exchange sensitive business data.

SolarWinds fixed four critical remote code execution vulnerabilities in Serv-U 15.5. These vulnerabilities could allow an attacker with administrative privileges to execute arbitrary native code as root on the affected server.

Vulnerability Name	CVE ID	Product Affected	Severity	CVSS Score	Fixed Version
Broken Access Control Remote Code Execution Vulnerability	CVE-2025-40538	Serv-U	Critical	9.1	Serv-U 15.5.4
Type Confusion Remote Code Execution Vulnerability	CVE-2025-40539	Serv-U	Critical	9.1	Serv-U 15.5.4
Type Confusion Remote Code Execution Vulnerability	CVE-2025-40540	Serv-U	Critical	9.1	Serv-U 15.5.4
Insecure Direct Object Reference (IDOR) Remote Code Execution Vulnerability	CVE-2025-40541	Serv-U	Critical	9.1	Serv-U 15.5.4

Technical Summary

These critical vulnerabilities affect SolarWinds Serv-U version 15.5 and arise from weaknesses such as improper access control checks, type confusion errors, and insecure object reference handling.

If exploited, they may allow an attacker to run arbitrary native code with root-level privileges on the affected server.

Successful exploitation requires administrative access. Once obtained, an attacker could create unauthorized administrator accounts, and execute malicious code, potentially resulting in complete system compromise and further movement across the network.

SolarWinds strongly advises upgrading to Serv-U version 15.5.4 to address these security risks.

CVE ID	System Affected	Vulnerability Details	Impact
CVE-2025-40538	Serv-U 15.5	Improper access control enabling admin creation and root-level code execution	Admin account creation, full system compromise
CVE-2025-40539	Serv-U 15.5	Type confusion enabling arbitrary native code execution as root	Arbitrary native code execution
CVE-2025-40540	Serv-U 15.5	Type confusion leading to root-level native code execution	Root-level execution
CVE-2025-40541	Serv-U 15.5	IDOR enabling unauthorized access and root-level code execution	Remote code execution as root

Potential Consequences

Full server takeover

Privilege escalation

Lateral movement within enterprise network

Data exfiltration

Malware or backdoor deployment

Remediation:

Upgrade immediately to Serv-U product with below mentioning fixed version-

Serv-U 15.5.4

If immediate patching is not possible, apply the following temporary mitigations-

Restrict Serv-U administrative access to trusted IP ranges.

Enforce MFA for all Serv-U admin accounts.

Ensure services run with least privilege.

Conduct audit of newly created administrative accounts.

You can follow the recommendations below as a best practice-

Enforce strict administrative access controls.

Monitor logs for unauthorized privilege escalation.

Implement network segmentation for file transfer servers.

Apply regular patch management and vulnerability scanning.

Conclusion:
These four newly disclosed vulnerabilities in SolarWinds Serv-U represent critical remote code execution risks. Although exploitation has not been confirmed, Serv-U’s history of targeted attacks increases the urgency for patching.

Organizations should treat this as a priority patching event and immediately upgrade to Serv-U 15.5.4 to prevent potential root-level compromise.

References:

Serv-U 15.5.4 release notes

SolarWinds Patches 4 Critical Serv-U 15.5 Flaws Allowing Root Code Execution

Chrome Security Updates by Google Released For Actively Exploited Zero-Day 2026

Chrome update released to patch a zero-day vulnerability that has been exploited in the wild.

Critical Flaw Identified in Fortinet Product ‘FortiClientEMS’; Security Updates Released

Fortinet released security updates for CVE-2026-2164

Fortinet has recently addressed a critical security vulnerability, identified as CVE-2026-21643, in its FortiClientEMS product. This flaw is classified as a SQL injection vulnerability, enables unauthenticated remote attackers to execute arbitrary code or system commands on affected systems by sending specially crafted HTTP requests.

Fortinet has released security updates to address a critical flaw impacting FortiClientEMS that could lead to the execution of arbitrary code on susceptible systems.

Technical Details

With a CVSS v3.1 base score of 9.1, this vulnerability is considered critical and poses a significant risk to organizations relying on FortiClientEMS for endpoint management.

The flaws affect the following versions –

FortiClientEMS 7.2 (Not affected)
FortiClientEMS 7.4.4 (Upgrade to 7.4.5 or above)
FortiClientEMS 8.0 (Not affected)

The vulnerability, CVE-2026-21643, resides in the FortiClientEMS administrative web interface.

Reason for the flaw or vulnerability to appear is caused by improper neutralization of user-supplied input in SQL queries. The flaw allows an unauthenticated attacker to send specially crafted HTTP requests to the FortiClientEMS GUI.

This resulted in the execution of arbitrary SQL statements, leading to unauthorized access, data exfiltration, privilege escalation and remote code execution (RCE) on any primary system.

Remediation

Immediate patching is strongly recommended to prevent potential exploitation, as the vulnerability allows attackers to bypass authentication and gain full control over the targeted system.

In addition to patching, organizations should implement the following best practices to reduce exposure and detect potential exploitation attempts.
Administrators should review web server and application logs for unusual or unauthorized HTTP requests targeting the FortiClientEMS administrative interface.
Monitoring for unexpected creation of administrative accounts or the execution of system commands originating from the FortiClientEMS host can help identify compromise.
Restricting network access to the FortiClientEMS management interface to trusted IP addresses and enforcing strong authentication controls can further reduce the attack surface.

There is currently no evidence of exploitation in the wild but the flaw has been termed a high-priority issue for all organizations using the affected product version, reason the attack surface is vulnerable.

Fortinet has since acknowledged that the issue has been actively exploited by bad actors to create local admin accounts for persistence, make configuration changes granting VPN access to those accounts, and exfiltrate the firewall configurations.

Conclusion:

The vulnerability is not present in FortiClientEMS versions 7.2, 8.0, or FortiEMS Cloud. The issue has been resolved in FortiClientEMS version 7.4.5 and later.

In the past similar Fortinet SQL injection and remote code execution vulnerabilities were found in Fortinet products and was targeted by cybercriminals and state-sponsored actors for financial benefits.

Sources: FortiClientEMS CVE-2026-21643: Critical Unauthenticated SQL Injection Vulnerability Allows Remote Code Execution