Serv-U
CVE-2025-40549: SolarWinds Serv-U Path Restriction Bypass Vulnerability
A Path Restriction Bypass vulnerability exists in Serv-U that when abused, could give a malicious actor with access to admin privileges the ability to execute code on a directory.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Serv-U (Windows, Linux) SolarWinds Serv-U 15.5 | See the advisory |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
A Path Restriction Bypass vulnerability exists in Serv-U that when abused, could give a malicious actor with access to admin privileges the ability to execute code on a directory.
This issue requires administrative privileges to abuse. On Windows systems, this scored as medium due to differences in how paths and home directories are handled.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.