SolarWinds Patches 4 Critical Serv-U 15.5 Flaws Allowing Root Code Execution

SolarWinds Serv-U 15.5 contains four critical RCE vulnerabilities (CVE-2025-40538–40541) — including broken access control, type confusion, and an IDOR — that can enable creation of admin users and execution of native code as root. Patches are available in Serv-U 15.5.4; exploitation requires administrative privileges and SolarWinds reports no observed active exploitation, although prior Serv-U vulnerabilities have been exploited by groups like Storm-0322.