SolarWinds Serv-U 15.5.4 Fixes Four Privileged RCE Vulnerabilities

SolarWinds released Serv-U 15.5.4 to fix four critical CVEs (CVSS 9.1) in Serv-U 15.5 — including improper privilege management (allows creation of admin accounts), two type confusion flaws, and an IDOR — that let an attacker with administrative access execute native code at privileged/root level; organizations should upgrade immediately, restrict and monitor administrative access, enable MFA, hunt for suspicious admin activity, rotate credentials if compromise is suspected, and verify patches because no active exploitation was reported but the potential impact is high.