SolarWinds Serv-U 15.5: Four Critical Bugs, One Clear Message — Patch Now

If you run SolarWinds Serv-U in your environment, this is one of those updates you don't "schedule for later." SolarWinds just shipped fixes for four critical flaws in Serv-U 15.5 that could lead to remote code execution (RCE) with root-level privileges if attackers manage to exploit them.

What Was Fixed

All four vulnerabilities are rated 9.1 (Critical) on CVSS and affect Serv-U 15.5. SolarWinds addressed them in Serv-U 15.5.4.

Here's the quick breakdown:

"Do Attackers Need Admin Access?" Yes — But Don't Relax Yet

SolarWinds notes these flaws require administrative privileges to exploit successfully.

That sounds comforting until you remember how attackers typically work:

So "needs admin" doesn't mean "low risk." It usually means "high impact once they're in."

Windows vs Linux Impact

One detail SolarWinds called out is that Windows deployments may see medium risk in practice because Serv-U services often run under less-privileged service accounts by default (compared to the root-level impact described for privileged contexts).

Still, the safest assumption is: if someone gets the right privileges, this can become a full-system problem.

Patch Details: What You Should Do

Any Sign Of Exploitation In The Wild?

At the time of reporting, SolarWinds said it has not observed active exploitation of these specific flaws.

But Serv-U has history here, which is why people are taking this seriously.

Why This Matters: Serv-U Has Been Targeted Before

Older Serv-U vulnerabilities have been exploited in real attacks. For example, Microsoft previously reported a China-based threat actor (tracked as DEV-0322) using a Serv-U zero-day RCE in targeted attacks back in 2021.

And more recently, CVE-2024-28995 (a Serv-U directory traversal issue) was reported as exploited in the wild, showing that attackers do keep Serv-U on their radar.

Final Thoughts

This is one of those patch sets where the CVSS score matches the potential damage. Even if exploitation hasn't gone mainstream yet, managed file transfer tools are high-value targets, and Serv-U has a track record of being investigated and attacked.