All vulnerabilities

Servers and applications

CVE-2025-40549

A Path Restriction Bypass vulnerability exists in Serv-U that when abused, could give a malicious actor with access to admin privileges the ability to execute code on a directory. This issue requires administrative privileges to abuse. On Windows systems, this scored as medium due to differences in how paths and home directories are handled.

Severity
Critical 9.1
Published
18 Nov 2025
Last changed
18 Oct 2026
Added to UpHeron
1 Nov 2026
Fixed in
15.5.3
Sources
NVD

Affected software

SoftwareAffected versions
SolarWinds Serv-UServers and applications · cpe:a:solarwinds:serv-u
  • Every version before 15.5.3

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-40549
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-40549