{"id":217244,"date":"2026-02-24T14:55:00","date_gmt":"2026-02-24T19:55:00","guid":{"rendered":"https:\/\/news-you-need.com\/index.php\/2026\/02\/24\/patch-these-4-critical-make-me-root-solarwinds-bugs-asap-the-register\/"},"modified":"2026-02-25T07:55:08","modified_gmt":"2026-02-25T12:55:08","slug":"patch-these-4-critical-make-me-root-solarwinds-bugs-asap-the-register","status":"publish","type":"post","link":"https:\/\/news-you-need.com\/index.php\/2026\/02\/24\/patch-these-4-critical-make-me-root-solarwinds-bugs-asap-the-register\/","title":{"rendered":"Patch these 4 critical, make-me-root SolarWinds bugs ASAP \u2022 The Register"},"content":{"rendered":"<p><a href=\"https:\/\/www.theregister.com\/2026\/02\/24\/patch_these_4_critical_makemeroot\/\">Patch these 4 critical, make-me-root SolarWinds bugs ASAP \u2022 The Register<\/a><\/p>\n<p><a href=\"https:\/\/www.theregister.com\/2026\/02\/24\/patch_these_4_critical_makemeroot\/\">https:\/\/www.theregister.com\/2026\/02\/24\/patch_these_4_critical_makemeroot\/<\/a><\/p>\n<p>Publish Date: <a href=\"publish_date]\">2026-02-24 14:55:00<\/a><\/p>\n<p>Source Domain: <a href=\"www.theregister.com\">www.theregister.com<\/a><\/p>\n<p>If you run SolarWinds\u2019 Serv-U, you should patch promptly. Four critical vulnerabilities in the file transfer software can allow attackers to execute code as root.<\/p>\n<p>The four flaws, all of which earned a 9.1 CVSS rating, include a broken access control vulnerability (CVE-2025-40538), two type confusion bugs (CVE-2025-40540 and CVE-2025-40539), and an Insecure Direct Object Reference (IDOR) issue (CVE-2025-40541), all of which can lead to remote code execution (RCE).<\/p>\n<p>The most serious of the four, CVE-2025-40538, &#8220;gives a malicious actor the ability to create a system admin user and execute arbitrary code as a privileged account via domain admin or group admin privileges,&#8221; according to the vendor&#8217;s security advisory.<\/p>\n<p>Updating to the latest version, Serv-U 15.5.4, patches all four security holes.<\/p>\n<p>In a statement to The Register, SolarWinds said, &#8220;We are aware of the reported issues and successfully addressed them as part of the Serv-U 15.5.4 release. We have not observed exploitation. We remain committed to monitoring the situation, working closely with customers and partners to ensure issues are resolved quickly. SolarWinds continues to prioritize the swift resolution of CVEs to ensure the security and integrity of our software.&#8221;<\/p>\n<p>The good news is that all four require administrative privileges to abuse, and none of the new CVEs have appeared on the US Cybersecurity and Infrastructure Security Agency&#8217;s (CISA&#8217;s) catalog of Known Exploited Vulnerabilities &#8211; yet.\u00a0<\/p>\n<p>However, SolarWinds&#8217; products in general are a long-time favorite target for attackers, and CISA has added three earlier Serv-U bugs to its KEV, including one known to be used in ransomware infections.\u00a0<\/p>\n<p>Plus, criminals frequently abuse file sharing products (such as MOVEit, and GoAnywhere) because enterprises use them to store and transfer large volumes of highly sensitive files, such as&#8230;<\/p>\n<p><a href=\"https:\/\/www.theregister.com\/2026\/02\/24\/patch_these_4_critical_makemeroot\/\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Patch these 4 critical, make-me-root SolarWinds bugs ASAP \u2022 The Register https:\/\/www.theregister.com\/2026\/02\/24\/patch_these_4_critical_makemeroot\/ Publish Date: 2026-02-24&#8230;<\/p>\n","protected":false},"author":1,"featured_media":217245,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/regmedia.co.uk\/2022\/06\/14\/patch1_shutterstock.jpg","fifu_image_alt":"","footnotes":""},"categories":[15],"tags":[24,27],"class_list":["post-217244","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-cybersecurity","tag-vulnerability"],"_links":{"self":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/217244"}],"collection":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/comments?post=217244"}],"version-history":[{"count":1,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/217244\/revisions"}],"predecessor-version":[{"id":217246,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/217244\/revisions\/217246"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media\/217245"}],"wp:attachment":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media?parent=217244"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/categories?post=217244"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/tags?post=217244"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}