Broken access control in SolarWinds Serv-U allowing system admin creation and privileged code execution

CVE-2025-40538 is a broken access control / improper privilege management vulnerability in SolarWinds Serv-U affecting Serv-U 15.5. The flaw allows an attacker who already has Serv-U administrative privileges, specifically domain admin or group admin privileges, to create a new system administrator account and then execute arbitrary code in a privileged context. SolarWinds describes the issue as enabling arbitrary code execution as a privileged account; multiple supporting sources characterize the resulting execution context as root or equivalent privileged execution. The issue is network-reachable but requires high privileges to abuse, and on Windows deployments the vendor notes lower relative risk because Serv-U services often run under less-privileged service accounts by default.