--- title: Patch these 4 critical, make-me-root SolarWinds bugs ASAP description: Four critical vulnerabilities (CVE-2025-40538, CVE-2025-40539, CVE-2025-40540, CVE-2025-40541) have been discovered in SolarWinds Serv-U file transfer... canonical: https://daily.dev/posts/patch-these-4-critical-make-me-root-solarwinds-bugs-asap-a3r0l1cza twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Patch these 4 critical, make-me-root SolarWinds bugs ASAP | daily.dev og:description: Four critical vulnerabilities (CVE-2025-40538, CVE-2025-40539, CVE-2025-40540, CVE-2025-40541) have been discovered in SolarWinds Serv-U file transfer... og:url: https://daily.dev/posts/patch-these-4-critical-make-me-root-solarwinds-bugs-asap-a3r0l1cza og:image: https://api.daily.dev/og/posts/a3R0L1czA.png og:image:alt: Patch these 4 critical, make-me-root SolarWinds bugs ASAP og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Patch these 4 critical, make-me-root SolarWinds bugs ASAP **[The Register](https://daily.dev/sources/theregister)** · 3 min read · 0 upvotes · 0 comments ## Summary Four critical vulnerabilities (CVE-2025-40538, CVE-2025-40539, CVE-2025-40540, CVE-2025-40541) have been discovered in SolarWinds Serv-U file transfer software, each rated 9.1 CVSS. The flaws include broken access control, two type confusion bugs, and an IDOR issue, all enabling remote code execution as root. The most severe allows creation of a system admin user and arbitrary code execution. Exploitation requires administrative privileges and none have been observed in the wild yet, but SolarWinds products are historically high-value targets. Updating to Serv-U 15.5.4 patches all four vulnerabilities. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [CISA: Hackers now exploit SolarWinds Serv-U flaw to crash servers](https://daily.dev/posts/cisa-hackers-now-exploit-solarwinds-serv-u-flaw-to-crash-servers-yw8vsu17o) · BleepingComputer · 0 upvotes · 0 comments - [New SAP NetWeaver Bug Lets Attackers Take Over Servers Without Login](https://daily.dev/posts/new-sap-netweaver-bug-lets-attackers-take-over-servers-without-login-dfzzmbvo2) · The Hacker News · 0 upvotes · 0 comments - [Master Key Included: Detecting SolarWinds ARM CVE-2026-28326](https://daily.dev/posts/master-key-included-detecting-solarwinds-arm-cve-2026-28326-dpxxppcpz) · Sliver C2 Documentation · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber) [View this post on daily.dev](https://daily.dev/posts/patch-these-4-critical-make-me-root-solarwinds-bugs-asap-a3r0l1cza) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Patch these 4 critical, make-me-root SolarWinds bugs ASAP","url":"https://daily.dev/posts/patch-these-4-critical-make-me-root-solarwinds-bugs-asap-a3r0l1cza","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/patch-these-4-critical-make-me-root-solarwinds-bugs-asap-a3r0l1cza"},"datePublished":"2026-02-24T19:59:57.793Z","dateModified":"2026-02-26T17:03:41.350Z","description":"Four critical vulnerabilities (CVE-2025-40538, CVE-2025-40539, CVE-2025-40540, CVE-2025-40541) have been discovered in SolarWinds Serv-U file transfer...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f6eea21289f238e4e196a4cbb1e2002c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f6eea21289f238e4e196a4cbb1e2002c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Register","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Register","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/66aa2113fdad463992ffcbf0e8963fda","url":"https://daily.dev/sources/theregister"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/patch-these-4-critical-make-me-root-solarwinds-bugs-asap-a3r0l1cza","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Register","item":"https://daily.dev/sources/theregister"},{"@type":"ListItem","position":3,"name":"Patch these 4 critical, make-me-root SolarWinds bugs ASAP"}]} ```