SB2026022404 - Multiple vulnerabilities in SolarWinds Serv-U

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Improper access control (CVE-ID: CVE-2025-40538)

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote attacker can bypass implemented security restrictions and execute arbitrary code on the target system.

2) Type Confusion (CVE-ID: CVE-2025-40540)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error. A remote attacker can pass specially crafted data to the application, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

3) Type Confusion (CVE-ID: CVE-2025-40539)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error. A remote attacker can pass specially crafted data to the application, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

4) Improper access control (CVE-ID: CVE-2025-40541)

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to Insecure Direct Object Reference (IDOR) issue. A remote attacker can bypass implemented security restrictions and execute arbitrary code on the system.

Remediation

Install update from vendor's website.

References

• https://documentation.solarwinds.com/en/Success_Center/servu/Content/release_notes/servu_15-5-4_release_notes.htm