Insecure Direct Object Reference Vulnerability in Serv-U by SolarWinds

CVE-2025-40541

What is CVE-2025-40541?

An Insecure Direct Object Reference vulnerability has been identified in Serv-U, allowing attackers with administrative privileges to execute native code as a privileged user. This vulnerability particularly poses a risk when the application is running under a less-privileged service account, which is common in Windows deployments. Users are encouraged to review their configurations and apply necessary updates to mitigate potential exploitation.

References