CVE-2025-40547
A logic error vulnerability exists in Serv-U which when abused could give a malicious actor with access to admin privileges the ability to execute code. This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a medium because services frequently run under less-privileged service accounts by default.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.1
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
- EPSS probability
- 0.89%
- CWE
- CWE-116
- Published
- 2025-11-18
- Last modified
- 2026-03-12
Affected products
- SolarWinds Serv-U
Weakness type
Related vulnerabilities
- CVE-2026-88060 — Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements
- CVE-2026-88058 — Angular: SSR XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements
- CVE-2026-88921 — MISP: Unescaped HTML Injection in PDF Report Element Rendering
- CVE-2026-54694 — NationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account Takeover
- CVE-2026-79964 — Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to...
- CVE-2026-79952 — Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to...
- CVE-2026-87550 — Improper encoding or escaping of output in CSS in Google Chrome prior to 153.0.8010.36 allowed a...
- CVE-2026-69821 — Active Directory Certificate Services (AD CS) Elevation of Privilege Vulnerability