CVE-2025-40547 SolarWinds Serv-U Logic Abuse - Remote Code Execution Vulnerability
An attacker with admin privileges can exploit a logic error in Serv-U to execute arbitrary code on the server.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-40547?
CVE-2025-40547 is a critical code injection vulnerability in Solarwinds Serv-U, published on 18 Nov 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A logic error vulnerability exists in Serv-U which when abused could give a malicious actor with access to admin privileges the ability to execute code.
This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a medium because services frequently run under less-privileged service accounts by default.
Weakness: CWE-116
Which versions are affected by CVE-2025-40547?
It affects 1 product.
Products include Solarwinds Serv-U.
How do I fix CVE-2025-40547?
No fix has been published for CVE-2025-40547 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-40547 being exploited?
There is no known exploitation of CVE-2025-40547 in the wild and no public exploit code.
Other vulnerabilities in Solarwinds Serv-U
Sources
Also known as GHSA-3vfp-93wv-3cf2.