CVE-2025-40538criticalCWE-269

CVE-2025-40538: falha crítica em SolarWinds Serv-U

SolarWinds Serv-U Broken Access Control Remote Code Execution Vulnerability

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Serv-U

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.1epss 0.5%
A broken access control vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to create a system admin user and execute arbitrary code as a privileged account via domain admin or group admin privileges. This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a medium because services frequently run under less-privileged service accounts by default.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
SolarWinds · Serv-U
CVEs relacionadas — SolarWinds Serv-U

No mesmo produto, das mais perigosas para as menos.

CVE-2026-28318HIGHSolarWinds Serv-U Unauthenticated Denial of Service VulnerabilityEPSS 43.7%KEVCVE-2021-35247MEDIUMImproper Input Validation Vulnerability in Serv-UEPSS 3.6%KEVCVE-2021-35250HIGHDirectory Transversal Vulnerability in Serv-U 15.3EPSS 12.8%CVE-2024-45711HIGHSolarWinds Serv-U FTP Service Directory Traversal Remote Code Execution VulnerabilityEPSS 6.3%CVE-2021-35223HIGHExecute Command Function Allows Remote Code Execution (RCE)VulnerabilityEPSS 2.9%CVE-2026-28316CRITICALSolarWinds Serv-U Insecure Direct Object Reference (IDOR) VulnerabilityEPSS 2.1%