VulnerabilitycriticalExploited in the wild

SolarWinds Patches 4 Critical Serv-U 15.5 Flaws Allowing Root Code Execution

The Hacker Newsby @TheHackersNewsFeb 25, 2026 · 07:04 UTC (Feb 25, 2026)1 min read3 · 1 read

Read at thehackernews.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2025-40538 CVE-2025-40539 CVE-2025-40540 CVE-2025-40541 CVE-2021-35211 CVE-2021-35247 CVE-2024-28995

Tags: cve-2025-40538 cve-2025-40539 cve-2025-40540 cve-2025-40541 cve-2021-35211 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2021-35211	Unauthenticated RCE (Remote Memory Escape) in SolarWinds Serv-U	10.0	91%	KEVRansomware	Jul 14, 2021 KEV Nov 3, 2021
CVE-2021-35247	Actively Exploited Input Validation Flaw in SolarWinds Serv-U LDAP Login	5.3	3%	KEV	Jan 10, 2022 KEV Jan 21, 2022
CVE-2024-28995	Unauthenticated Path Traversal File-Read in SolarWinds Serv-U	7.5	100%	KEV	Jun 6, 2024 KEV Jul 17, 2024
CVE-2025-40541 +3 related CVEs CVE-2025-40538 CVE-2025-40539 CVE-2025-40540	An Insecure Direct Object Reference (IDOR) vulnerability exists in Serv-U, which when exploited, gives a malicious actor the ability to execute native code as…	7.2	<1%		Feb 24, 2026

From the original article

1 min read at thehackernews.com

 Ravie Lakshmanan  Feb 25, 2026 Vulnerability / Windows Security SolarWinds has released updates to address four critical security flaws in its Serv-U file transfer software that, if successfully exploited, could result in remote code execution. The vulnerabilities, all rated 9. 1 on the CVSS scoring system, are listed below -

The Hacker News

By @TheHackersNews · thehackernews.com

Read the full article at The Hacker News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.