CVE-2025-40539
Critical · 9.1CVSS
9.1
EPSS
0.5%
Published
Feb 24, 2026
CISA due date
—
The record
A type confusion vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to execute arbitrary native code as privileged account. This issue requires administrative privileges to abuse. On Windows deployments, the risk is scored as a medium because services frequently run under less-privileged service accounts by default.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-105754 vLLM is an inference and serving engine for large language models. CWE-704
- CVE-2026-10080 Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fails to… CWE-704
- CVE-2026-15826 The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via… CWE-704
- CVE-2026-53798 rsync before 3.5.0 contains a privilege confusion vulnerability in the name-converter… CWE-704
- CVE-2026-73429 Russh is a Rust SSH client & server library. CWE-704
- CVE-2026-18675 The dataplane token validator in kuma-cp performs an unchecked Go type assertion on the… CWE-704
- CVE-2026-6726 An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that… CWE-704
- CVE-2026-50337 Incorrect type conversion or cast in Windows Notification allows an authorized attacker… CWE-704