SolarWinds on Tuesday announced patches for four critical-severity vulnerabilities in its enterprise file transfer solution, Serv-U. All four security defects, tracked as CVE-2025-40538 to CVE-2025-40541, have a CVSS score of 9.1, could result in remote code execution, and impact Serv-U version 15.5. CVE-2025-40538, SolarWinds explains, is a broken access control issue that could allow threat actors to create a system admin user and execute arbitrary code with the elevated privileges of domain admin or group admin. CVE-2025-40539 and CVE-2025-40540 are type confusion flaws that allow attackers to execute code with elevated privileges, the company notes, without providing additional details. CVE-2025-40541 is described as an insecure direct object reference (IDOR) bug leading to the…