- 255/2025
- Critical
SolarWinds has released security updates to address several vulnerabilities affecting multiple SolarWinds products.
The addressed vulnerabilities could allow the attacker to bypass security restrictions, conduct phishing attacks, execute arbitrary code on a directory via admin privileges, and gain access to the affected system.
Sample of the addressed vulnerabilities:
1. SolarWinds Serv-U Logic Abuse – Remote Code Execution Vulnerability (CVE-2025-40547):
- CVSS: 9.1
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: High
- User Interaction: None
- Consequences: Gain Access
2. SolarWinds Serv-U Path Restriction Bypass Vulnerability (CVE-2025-40549):
- CVSS: 9.1
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: High
- User Interaction: None
- Consequences: Bypass Security
The affected products:
- SolarWinds Observability Self-Hosted 2025.4 and prior versions.
- SolarWinds Serv-U 15.5.2.2.102.
Vulnerabilities
- CVE-2025-40545
- CVE-2025-40547
- CVE-2025-40548
- CVE-2025-40549
Mitigations
The enterprise should deploy this patch as soon as the testing phase is completed.