SolarWinds Serv-U Vulnerabilities Allow Root Remote Code Execution: Patch Now

SolarWinds fixed four critical Serv-U vulnerabilities that let attackers gain root access remotely. All carry CVSS 9.1 scores. They hit access controls, web interfaces, and APIs. Update to version 15.5.4 immediately. SolarWinds release notes state: “These patches address CVE-2025-40538 through CVE-2025-40541, preventing unauthorized admin creation and RCE.” 

Serv-U manages secure file transfers in enterprises. Flaws allow domain admins to create system admins, then run code as root. Type confusion bugs corrupt memory for direct execution. An IDOR issue bypasses checks on objects.

SolarWinds credits researchers for disclosure. No known exploits as of February 26, 2026. Check NVD for updates. Older versions like 15.5.1 hit end-of-engineering support on February 18, 2026.

Attackers could deploy ransomware or backdoors. Impacts include data theft from networks. File servers often hold sensitive info, making quick patches vital.

Version 15.5.4 adds Ubuntu 24.04 support and UI tweaks like download history.

Vulnerability Breakdown

New Features in 15.5.4

• Ubuntu 24.04 LTS support.
• File Share download history.
• Precise last-modified timestamps.
• Strict Content Security Policy.
• Legacy login anti-clickjacking.

Patch Steps

Apply updates fast.

• Download from SolarWinds customer portal.
• Review EOL for versions below 15.5.1.
• Test in staging for file shares.
• Scan networks for exposed Serv-U.
• Enable logging for admin changes.

FAQ