CVE-2025-40547
CriticalSummary
Serv-U contains a logic error vulnerability that, when abused, could give a malicious actor with admin privileges the ability to execute code. This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as medium because services frequently run under less-privileged service accounts by default.
Risk Assessment
An attacker with admin privileges could execute code, potentially leading to privilege escalation or full system compromise.
Recommendation
It is recommended to restrict administrative privileges, monitor administrator activities, and apply available vendor patches.
Other vulnerabilities in Serv-U
See all- CVE-2025-40549Critical
Serv-U contains a Path Restriction Bypass vulnerability that, when abused, could give a malicious actor with admin privileges the ability to execute code on a directory. This issue requires administrative privileges to abuse. On Windows systems, this is scored as medium due to differences in how paths and home directories are handled.
- CVE-2025-40548Critical
Serv-U contains a missing validation process vulnerability that, when abused, could give a malicious actor with admin privileges the ability to execute code. This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as medium because services frequently run under less-privileged service accounts by default.
- CVE-2021-35247MediumActively exploited
The Serv-U web login screen for LDAP authentication allowed characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization.
- CVE-2023-35179High
A vulnerability has been identified within Serv-U 15.4 that allows bypassing multi-factor/two-factor authentication. The actor must have administrator-level access to Serv-U to perform this action.
Original NVD description (English source)
A logic error vulnerability exists in Serv-U which when abused could give a malicious actor with access to admin privileges the ability to execute code. This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a medium because services frequently run under less-privileged service accounts by default.