Home / Vulnerability Intelligence / CVE-2025-40539

CVE-2025-40539 - Vulnerability Analysis

CriticalCVSS: 9.1

Last Updated: February 24, 2026

Serv-U - Code Execution & Privilege Escalation

Published: February 24, 2026Updated: February 24, 2026Remote Exploitable

Overview

Serv-U contains a type confusion vulnerability that allows attackers with administrative privileges to execute arbitrary native code as a privileged account, exploit requires administrative privileges.

Severity & Score

Severity: Critical

CVSS Score: 9.1

EPSS Score: 4.8%(Probability of exploitation in next 30 days)

Impact

Attackers with administrative privileges can execute arbitrary native code with elevated privileges, potentially compromising the entire system.

Mitigation

Update to the latest version of Serv-U.

References

Social Media Activity(1 post)

Raphael

@0x3e4

Feb 25, 2026

latest SolarWinds CVEs.. all critical lmao.. patch patch patch! CVE-2025-40538 - Improper Privilege Management CVE-2025-40539 - Incorrect Type Conversion or Cast CVE-2025-40540 - Incorrect Type Conversion or Cast CVE-2025-40541 - Incorrect Type Conversion or Cast & Authorization Bypass Through User-Controlled Key SolarWinds Serv-U 15.5.3 and prior versions https://hecate.pw/vulnerabilities?search=vendors%3A%22SolarWinds%22+AND+published%3A%3E%3D2026-02-22&mode=dql #vulnerability #security #solarwinds

View original post

Related Resources

Details

CVE ID: CVE-2025-40539
Severity: Critical
CVSS Score: 9.1
Type: undefined
Status: confirmed
EPSS: 4.8%
Social Posts: 1

CWE

CWE-704

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS Score

4.8%Probability of exploitation in the next 30 days