Critical severity9.1NVD Advisory· Published Feb 24, 2026· Updated Jun 17, 2026
CVE-2025-40538
CVE-2025-40538
Description
A broken access control vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to create a system admin user and execute arbitrary code as a privileged account via domain admin or group admin privileges.
This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a medium because services frequently run under less-privileged service accounts by default.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4cpe:2.3:a:solarwinds:serv-u:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:solarwinds:serv-u:*:*:*:*:*:*:*:*range: <15.5.4
- (no CPE)
- (no CPE)range: SolarWinds Serv-U 15.5.3 and prior versions
Patches
Vulnerability mechanics
References
2- documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-5-4_release_notes.htmnvdRelease NotesVendor Advisory
- www.solarwinds.com/trust-center/security-advisories/CVE-2025-40538nvdVendor Advisory
News mentions
0No linked articles in our index yet.