InfoSecBulletin Cybersecurity for mankind
New vulnerabilities in SolarWinds Serv-U pose serious risks by allowing attackers to gain full control of the system. SolarWinds has revealed four critical Remote Code Execution (RCE) flaws, each with a CVSS score of 9.1.
The vulnerabilities in Serv-U 15.5.4 include Broken Access Control, Type Confusion, and Insecure Direct Object Reference (IDOR). If exploited, these flaws allow attackers to execute arbitrary code as the root user.
Daily Cyber security update for 25. 10. 2026
Daily Cyber security update for 24. 10. 2026
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
Update now! PHP2Shell: Critical PHP vulnerabilities patched
Trump says data centres should pay dividends to local community
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
CVE-2025-40538 is a serious vulnerability due to broken access control, enabling attackers to gain complete control of the system.
According to the release notes, “A broken access control vulnerability exists in Serv-U which, when exploited, gives an attacker the ability to create a system admin user and execute arbitrary code as root via domain admin or group admin privileges.”
By allowing an attacker to artificially mint their own system administrator credentials, this flaw bypasses traditional perimeter defenses and grants persistent, highly privileged access.
The remaining three vulnerabilities are equally critical, offering alternative routes to root-level remote code execution:
CVE-2025-40539 & CVE-2025-40540 (Type Confusion): Two vulnerabilities arise from memory safety issues. If exploited, they can let an attacker manipulate memory management to run arbitrary code as root.
CVE-2025-40541 (IDOR): An Insecure Direct Object Reference (IDOR) vulnerability allows unauthorized data access. In this case, a flaw in Serv-U can lead to remote code execution with root privileges.
Managed file transfer (MFT) solutions like Serv-U are often directly accessible on the public internet for external file sharing, making them attractive targets for initial access brokers and ransomware attackers.
SolarWinds Serv-U 15.5.4 addresses four critical CVEs. Administrators should update immediately to prevent unauthorized root access.
