PT-2026-21668 · Solarwinds · Serv-U

Published 2026-02-24 · Updated 2026-03-10 · CVE-2025-40539

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Serv-U (affected versions not specified)

Description A type confusion issue exists in Serv-U, potentially allowing a malicious actor to execute arbitrary native code with elevated privileges. Exploitation of this issue requires administrative privileges. On Windows systems, the risk is considered moderate because services often operate under less-privileged service accounts by default.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Incorrect Type Conversion or Cast

Weakness Enumeration

CWE-704

Related Identifiers

CVE-2025-40539

Affected Products

Serv-U

References · 16

• https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-5-4_release_notes.htm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-40539 · Vendor Advisory
• https://solarwinds.com/trust-center/security-advisories/CVE-2025-40539 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-40539 · Security Note
• https://twitter.com/cracbot/status/2027700473470587121 · Twitter Post
• https://twitter.com/CveTodo/status/2026213550704714087 · Twitter Post
• https://twitter.com/CveFindCom/status/2026215882435838038 · Twitter Post
• https://twitter.com/CCBalert/status/2026684982597497071 · Twitter Post
• https://twitter.com/SecAlertsCo/status/2026489674374722044 · Twitter Post
• https://twitter.com/cracbot/status/2028062784525898090 · Twitter Post
• https://reddit.com/r/Action1/comments/1rq3lpr/patch_tuesday_march_2026 · Reddit Post
• https://t.me/true_secator/7946 · Telegram Post
• https://twitter.com/CVEnew/status/2026265019948618056 · Twitter Post
• https://twitter.com/johndjohnson/status/2027416822430195739 · Twitter Post
• https://t.me/CVEtracker/45581 · Telegram Post