Critical severity9.1NVD Advisory· Published Feb 24, 2026· Updated Jun 17, 2026
CVE-2025-40540
CVE-2025-40540
Description
A type confusion vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to execute arbitrary native code as privileged account.
This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a medium because services frequently run under less-privileged service accounts by default.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4cpe:2.3:a:solarwinds:serv-u:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:solarwinds:serv-u:*:*:*:*:*:*:*:*range: <15.5.4
- (no CPE)
- (no CPE)range: SolarWinds Serv-U 15.5.3 and prior versions
Patches
Vulnerability mechanics
References
2- documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-5-4_release_notes.htmnvdRelease NotesVendor Advisory
- www.solarwinds.com/trust-center/security-advisories/CVE-2025-40540nvdVendor Advisory
News mentions
0No linked articles in our index yet.