CVE-2025-40547: A logic error vulnerability exists in Serv-U which when abused could give a malicious actor with access to admin privileges the ability to execute code. This…

PriorityP354critical9.1CVSS 3.1

AVNACLPRHUINSCCHIHAH

EPSS

0.82%

52.6th percentile

A logic error vulnerability exists in Serv-U which when abused could give a malicious actor with access to admin privileges the ability to execute code. This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a medium because services frequently run under less-privileged service accounts by default.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
solarwinds	serv-u	< 15.5.3	15.5.3
solarwinds	serv-u	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.