[HIGH] CVE-2025-40539 — CVSS 7.2 (February 24, 2026)

A HIGH-severity vulnerability identified as CVE-2025-40539 has been published on February 24, 2026 with a CVSS base score of 7.2. The vulnerability affects Solarwinds Serv-u. This security advisory provides a detailed breakdown of the vulnerability, its potential impact, weakness classification, and actionable steps to protect your systems.

Vulnerability Details

CVE ID: CVE-2025-40539
Severity: HIGH
CVSS Score: 7.2
Published: February 24, 2026
Affected Product: Solarwinds Serv-u
Weakness (CWE): CWE-704

Technical Description

A type confusion vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to execute arbitrary native code as privileged account. This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a medium because services frequently run under less-privileged service accounts by default.

Potential Impact

If exploited, this high-severity vulnerability could allow an attacker to compromise sensitive data confidentiality, tamper with system integrity, cause a denial of service. Organizations running Solarwinds Serv-u should treat this as a priority remediation item.

Recommended Action

A patch or vendor advisory is available. Take the following steps immediately:

1. Review the vendor advisory linked in the References section below.
2. Identify all instances of the affected software in your environment.
3. Apply the available patch or upgrade to the fixed version as soon as possible.
4. If patching is not immediately possible, implement compensating controls such as WAF rules, network segmentation, or disabling the affected feature.
5. Monitor your systems for signs of exploitation using your SIEM or IDS/IPS.

View full details on NVD →

References

• Release Notes, Vendor Advisory
• Vendor Advisory

Related Security Advisories

• [HIGH] CVE-2025-40540 — CVSS 7.2 (February 24, 2026) — HIGH / CVSS 7.2
• [HIGH] CVE-2026-1367 — CVSS 8.3 (February 23, 2026) — HIGH / CVSS 8.3
• [HIGH] CVE-2026-27466 — CVSS 7.2 (February 21, 2026) — HIGH / CVSS 7.2