CVE-2025-40549 - CVE House

Back to Database

Status published Critical CVE-2025-40549

SolarWinds Serv-U Path Restriction Bypass Vulnerability

9.1 CVSS

Vulnerability Description

A Path Restriction Bypass vulnerability exists in Serv-U that when abused, could give a malicious actor with access to admin privileges the ability to execute code on a directory. This issue requires administrative privileges to abuse. On Windows systems, this scored as medium due to differences in how paths and home directories are handled.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-40549

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Maurice Moss

References

More from SolarWinds

View All →

SolarWinds Web Help Desk Authentication Bypass Vulnerability

SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability

SolarWinds Web Help Desk Authentication Bypass Vulnerability

SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability

SolarWinds Serv-U Broken Access Control - Remote Code Execution Vulnerability

Affected Vendor

SolarWinds

View all reports →

Affected Software

Serv-U

Vulnerable Versions:

SolarWinds Serv-U 15.5.2 and prior versions

Timeline

Official Publish: November 18th, 2025

Last Modified: February 26th, 2026

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1005 Data from Local System

T1552 Unsecured Credentials

Credential Access

T1565.001 Stored Data Manipulation