![Wanted: Suspect for Multiple Robberies in the 3rd District [VIDEO]](https://thephillypi.com/wp-content/uploads/2026/07/Wanted-Suspect-for-Multiple-Robberies-in-the-3rd-District-VIDEO-330x220.jpg "Wanted: Suspect for Multiple Robberies in the 3rd District [VIDEO]")
SolarWinds addressed four critical Serv-U vulnerabilities that could let attackers gain root access to unpatched servers.
SolarWinds released updates fixing four critical Serv-U vulnerabilities that allow remote code execution, potentially giving attackers full root access on unpatched servers.
Serv-U is a file transfer server software that allows organizations to securely transfer files over networks using protocols like FTP, FTPS, SFTP, and HTTP/S. It’s commonly used by businesses to manage and exchange large files safely, including between internal teams and external partners.
One of the flaws fixed by the company is a broken access control issue, tracked as CVE-2025-40538 (CVSS score of 9.1), that could be exploited by attackers with high privileges to gain root or admin access on vulnerable systems.
“A broken access control vulnerability exists in Serv-U which, when exploited, gives an attacker the ability to create a system admin user and execute arbitrary code as root via domain admin or group admin privileges.” reads the advisory.
EXPLORE MORE
Middle east crisis prompts UK NCSC warning on potential Iranian cyber activity
UK’s NCSC warns of potential Iranian cyberattacks as Middle East tensions rise,…
Canadian Tire 2025 data breach impacts 38 million users
A data breach at Canadian Tire exposed personal data from over 38…
Massachusetts House Democrats vote to legalize unlimited abortion up to birth
BOSTON — The Massachusetts House has passed legislation eliminating the need for…
U.S. CISA adds a flaw in Soliton Systems K.K FileZen to its Known Exploited Vulnerabilities catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a flaw in…
Trump teleprompter operator probed for alleged insider betting
Veteran White House staffer Gabriel Perez is believed to have made more…
‘Bubble zone’ law targeting drag queen protests faces constitutional challenge
A Canadian constitutional freedom group announced that an appeals court will hear…
The second flaw is CVE-2025-40540 (CVSS score of 9.1), a type confusion vulnerability in Serv-U that, if exploited, allows an attacker to execute arbitrary native code as root, giving them full control of the affected server.
The third flaw is CVE-2025-40539 (CVSS score of 9.1), another type confusion vulnerability. Similar to the previous one, it enables an attacker to run arbitrary native code with root privileges, potentially compromising the entire system.
The last flaw is CVE-2025-40541 (CVSS score of 9.1), an Insecure Direct Object Reference (IDOR) vulnerability in Serv-U. Exploiting this flaw allows an attacker to execute native code as root, risking complete server compromise on unpatched systems.
In November 2025, SolarWinds addressed three other critical vulnerabilities (CVE-2025-40549, CVE-2025-40548, CVE-2025-40547) in its Serv-U file transfer solution that could allow remote code execution.
In July 2024, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the CVE-2024-28995 SolarWinds Serv-U Path Traversal Vulnerability to its Known Exploited Vulnerabilities (KEV) catalog:
