GCVE-110-NCSC-2026-69

Advisory PublishedCVSS 9.1/10

Vulnetix · Advisory published February 25, 2026

A broken access control vulnerability in Serv-U allows attackers with administrative privileges to create a system admin user and execute arbitrary code with elevated rights, posing a medium risk on Windows due to default service account restrictions.

Download JSON Open in Console

Weaknesses (CWE)

CWE-269Improper Privilege ManagementCWE-704Incorrect Type Conversion or Cast

Risk Scores

CVSS 3.1

9.1/10

Critical · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
SolarWinds	vers:unknown/*	—	—

Aliases

CVE-2025-40538 CVE-2025-40539 CVE-2025-40540 CVE-2025-40541

References

advisory

Browse GCVE Records

73,393 records in the GCVE database · Updated July 17, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON