{"id":"CVE-2025-40548","title":"A missing validation process exists in Serv U when abused, could give a malicious actor with access to admin privileges the ability to execute code","summary":"A missing validation process exists in Serv U when abused, could give a malicious actor with access to admin privileges the ability to execute code. \n\nThis issue requires administrative privileges to abuse. On Windows deployments, the ri…","severity":"critical","cvss":9.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cwe":["CWE-269"],"vendor":"solarwinds","product":"serv-u","affected":["serv-u < 15.5.3"],"patched":["serv-u 15.5.3"],"published":"2025-11-18","updated":"2026-10-07","sourceUpdated":"2026-10-07T21:10:00.200","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-40548","references":[{"url":"https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-5-3_release_notes.htm","label":"psirt@solarwinds.com"},{"url":"https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-40548","label":"psirt@solarwinds.com"}],"tags":["nvd"],"epss":0.00699,"epssPercentile":0.51654,"ingestedAt":"2026-10-07T21:54:15.068Z","slug":"CVE-2025-40548","body":"## Overview\n\nA missing validation process exists in Serv U when abused, could give a malicious actor with access to admin privileges the ability to execute code. \n\nThis issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a medium because services frequently run under less-privileged service accounts by default.\n\n## Affected\n\n- `serv-u < 15.5.3`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `serv-u 15.5.3`","depth":"midnight","depthScore":50,"depthScoreParts":{"impact":50.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}