InfoSecBulletin Cybersecurity for mankind
New vulnerabilities in SolarWinds Serv-U pose serious risks by allowing attackers to gain full control of the system. SolarWinds has revealed four critical Remote Code Execution (RCE) flaws, each with a CVSS score of 9.1.
The vulnerabilities in Serv-U 15.5.4 include Broken Access Control, Type Confusion, and Insecure Direct Object Reference (IDOR). If exploited, these flaws allow attackers to execute arbitrary code as the root user.
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
CVE-2025-40538 is a serious vulnerability due to broken access control, enabling attackers to gain complete control of the system.
According to the release notes, “A broken access control vulnerability exists in Serv-U which, when exploited, gives an attacker the ability to create a system admin user and execute arbitrary code as root via domain admin or group admin privileges.”
By allowing an attacker to artificially mint their own system administrator credentials, this flaw bypasses traditional perimeter defenses and grants persistent, highly privileged access.
The remaining three vulnerabilities are equally critical, offering alternative routes to root-level remote code execution:
CVE-2025-40539 & CVE-2025-40540 (Type Confusion): Two vulnerabilities arise from memory safety issues. If exploited, they can let an attacker manipulate memory management to run arbitrary code as root.
CVE-2025-40541 (IDOR): An Insecure Direct Object Reference (IDOR) vulnerability allows unauthorized data access. In this case, a flaw in Serv-U can lead to remote code execution with root privileges.
Managed file transfer (MFT) solutions like Serv-U are often directly accessible on the public internet for external file sharing, making them attractive targets for initial access brokers and ransomware attackers.
SolarWinds Serv-U 15.5.4 addresses four critical CVEs. Administrators should update immediately to prevent unauthorized root access.
