CVE-2025-40548: RCE in SolarWinds Serv-U

Successful exploitation of CVE-2025-40548 grants an attacker complete control over the affected system. An attacker with administrative privileges can execute arbitrary code, potentially leading to data exfiltration, system compromise, and lateral movement within the network. The impact is particularly severe given Serv-U's role in file transfer and potential access to sensitive data. While the Windows default service account configuration mitigates the risk slightly, administrative access remains a critical concern. This vulnerability could be leveraged to install malware, create backdoors, or disrupt operations.

1. Reserved2025-04-16
2. Published2025-11-18
3. Modified2026-02-26
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-40548 is to upgrade to SolarWinds Serv-U version 15.5.3 or later. If an immediate upgrade is not feasible, consider restricting administrative access to Serv-U and implementing strict network segmentation to limit the potential blast radius. Review Serv-U's configuration to ensure it adheres to the principle of least privilege. While a direct WAF rule is unlikely to be effective, monitoring network traffic for suspicious connections to Serv-U on unusual ports could provide early detection. After upgrading, confirm the fix by attempting to trigger the vulnerable functionality and verifying that it is no longer exploitable.