Raw vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:HSummary
CVE-2025-40541 is a critical-severity Incorrect Type Conversion or Cast (CWE-704) vulnerability in Solarwinds Serv-U. Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 44th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-24 (Access Control Decisions) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-40541 is an Insecure Direct Object Reference (IDOR) vulnerability in SolarWinds Serv-U, classified under CWE-639 and CWE-704. When exploited, it enables a malicious actor to execute native code as a privileged account. The vulnerability carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) and was published on 2026-02-24.
Exploitation requires administrative privileges (PR:H), limiting it to attackers who have already gained high-level access within the Serv-U environment. Such an actor can trigger the issue remotely over the network (AV:N) with low attack complexity and no user interaction (UI:N), resulting in high impacts to confidentiality, integrity, and availability, along with a changed scope (S:C). On Windows deployments, the risk is rated as medium because Serv-U services typically run under less-privileged accounts by default.
SolarWinds has issued a security advisory detailing the issue at https://www.solarwinds.com/trust-center/security-advisories/CVE-2025-40541. Mitigation is available via Serv-U version 15.5.4, as outlined in the release notes at https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-5-4_release_notes.htm.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-207543
Vulnerability Data
An Insecure Direct Object Reference (IDOR) vulnerability exists in Serv-U, which when exploited, gives a malicious actor the ability to execute native code as a privileged account. This issue requires administrative privileges to abuse. On Windows deployments, the risk is…
more
scored as a medium because services frequently run under less-privileged service accounts by default.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforcing approved authorizations on every access request structurally stops a user-controlled key from reaching another user's data.
Requiring explicit access-control decisions on each request blocks unauthorized key-driven access.
Developer testing and evaluation (static analysis, fuzzing, unit tests) directly finds incorrect type conversions or casts.
Least-privilege restrictions limit the scope of data reachable even if a key check is bypassed.
Requiring documented development standards and tools can mandate safe typing, casting rules, and compiler checks that stop the weakness from being introduced.
Security engineering principles can require type-safe design and casting practices that structurally avoid incorrect conversions.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Enforcing authorization policy and least privilege directly blocks user-controlled key tampering that bypasses access checks.
Logical access controls prevent unauthorized data access that results from missing authorization checks on object references.
Secure SDLC practices directly prevent type-conversion flaws via coding standards, reviews, and testing.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can uncover type-conversion defects before release.
Information access restriction explicitly enforces that users may only retrieve data they are authorized to see, directly addressing user-controlled key bypass.
Access control policy directly requires enforcement of authorization rules that prevent unauthorized access via manipulated keys.
Managing access rights includes ensuring users can only access their own records and not bypass authorization by altering identifiers.
Privileged access rights control restricts what data each user may access, mitigating direct object reference attacks.
Secure development lifecycle includes type-safety reviews that reduce incorrect casts.