CVE-2025-40539
A type confusion vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to execute arbitrary native code as privileged account. This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a medium because services frequently run under less-privileged service accounts by default.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.1
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
- EPSS probability
- 0.45%
- CWE
- CWE-704
- Published
- 2026-02-24
- Last modified
- 2026-03-12
Affected products
- SolarWinds Serv-U
Weakness type
Related vulnerabilities
- CVE-2025-41646 — RevPi Webstatus application is vulnerable to an authentication bypass
- CVE-2010-20115 — Vermillion FTP <= 1.31 Daemon PORT Command Memory Corruption
- CVE-2025-41648 — Pilz: Authentication Bypass in IndustrialPI Webstatus
- CVE-2023-21651 — Incorrect Type Conversion or Cast in Core
- CVE-2025-40541 — SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Remote Code Execution Vulnerability
- CVE-2025-40540 — SolarWinds Serv-U Type Confusion Remote Code Execution Vulnerability
- CVE-2025-13720 — Bad cast in Loader in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who had compromised the renderer pr
- CVE-2021-39173 — Forced reinstall