SolarWinds has released critical security updates for Serv-U to address three vulnerabilities (CVE-2025-40547, CVE-2025-40548, and CVE-2025-40549) that could allow authenticated administrators to achieve root access or full system compromise.

Key Details of the Vulnerabilities

Each flaw carries a CVSS score of 9.1, reflecting a “Critical” severity level.

• CVE-2025-40547 (Logic Error): A flaw in output encoding/escaping that allows an administrator to execute arbitrary code.
• CVE-2025-40548 (Broken Access Control): Improper authorization that permits an attacker with admin privileges to run unauthorized code.
• CVE-2025-40549 (Path Traversal): A bypass of path restrictions enabling code execution in restricted directories.

Risk and Impact

• Target Scope: These flaws affect both the Serv-U FTP Server and Managed File Transfer (MFT) Server.
• Privilege Requirement: An attacker must already possess administrative privileges to exploit these specific vulnerabilities.
• Platform Variation: On Windows, the risk is rated “Medium” because Serv-U typically runs under less-privileged service accounts. On other systems where it may run as a superuser, it can grant full root access.
• Historical Context: SolarWinds products are frequent targets; CISA currently tracks nine Serv-U vulnerabilities that have been or are being exploited in the wild, such as the widely abused CVE-2024-28995 on SentinelOne.