SolarWinds Serv-U Vulnerabilities: 4 Critical RCE-Levels Discovered

SolarWinds has recently fixed four critical vulnerabilities in its popular Serv-U file transfer solution. These flaws can allow attackers to create a system admin user and/or execute code as a privileged account, making them highly dangerous. In this article, we will explore the details of these vulnerabilities and what you can do to protect yourself.

What are the SolarWinds Serv-U Vulnerabilities?

SolarWinds Serv-U is a file transfer solution that runs on Windows or Linux and lets users securely transfer files between computers or systems using standard protocols like FTP, FTPS, SFTP, HTTP, and HTTPS. The four fixed vulnerabilities, all rated ‘critical’, are:

• CVE-2025-40538: Broken access control flaw that gives a malicious actor the ability to create a system admin user and execute arbitrary code as a privileged account via domain admin or group admin privileges.
• CVE-2025-40539 and CVE-2025-40540: Type confusion bugs that allow attackers to execute arbitrary native code as privileged account (root).
• CVE-2025-40541: An Insecure Direct Object Reference bug that could lead to arbitrary code execution as root.

How Can These Vulnerabilities be Exploited?

These vulnerabilities can be exploited remotely, in low complexity attacks, with no user interaction required. However, the attacker must already have high-level access to the setup. As Orca researchers noted, ‘in real-world scenarios where administrative credentials are compromised — through phishing, password reuse, or credential spraying — they significantly increase the impact of that compromise.’

What Should You Do to Protect Yourself?

SolarWinds says that all four vulnerabilities are less critical on Windows deployments, ‘because services frequently run under less-privileged service accounts by default.’ However, it is still essential to upgrade to v15.5.4 as soon as possible to ensure your security. There is currently no indication of in-the-wild exploitation of these flaws, but like many other file-transfer server solutions, Serv-U is an attractive target for attackers and vulnerabilities in it – including zero-days – have been exploited in the past.

Conclusion

In conclusion, the four critical vulnerabilities in SolarWinds Serv-U are a significant threat to your security. It is crucial to upgrade to v15.5.4 as soon as possible to protect yourself from potential attacks. Remember to always stay vigilant and keep your software up to date to ensure your security.

Frequently Asked Questions

1. What are the SolarWinds Serv-U vulnerabilities? The SolarWinds Serv-U vulnerabilities are four critical flaws that can allow attackers to create a system admin user and/or execute code as a privileged account.
2. How can these vulnerabilities be exploited? These vulnerabilities can be exploited remotely, in low complexity attacks, with no user interaction required.
3. What should I do to protect myself? You should upgrade to v15.5.4 as soon as possible to ensure your security.
4. Are these vulnerabilities more critical on Windows or Linux? These vulnerabilities are less critical on Windows deployments, but it is still essential to upgrade to v15.5.4 as soon as possible.
5. Have these vulnerabilities been exploited in the wild? There is currently no indication of in-the-wild exploitation of these flaws.