CVE-2023-40060

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A vulnerability has been identified within Serv-U 15.4 and 15.4 Hotfix 1 that, if exploited, allows an actor to bypass multi-factor/two-factor authentication. The actor must have administrator-level access to Serv-U to perform this action. 15.4. SolarWinds found that the issue was not completely fixed in 15.4 Hotfix 1.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
SolarWinds	Serv-U	>= 15.4, <= 15.4 Hotfix 1

References

https://support.solarwinds.com/SuccessCenter/s/article/Serv-U-15-4-0-Hotfix-2?language=en_USVendor Advisory
https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-40060Vendor Advisory
https://support.solarwinds.com/SuccessCenter/s/article/Serv-U-15-4-0-Hotfix-2?language=en_USVendor Advisory
https://www.solarwinds.com/trust-center/security-advisories/CVE-2023-40060Vendor Advisory

Timeline

Published: Sep 7, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-400618.8Insecure job execution mechanism vulnerability. This vulnerability can lead to other attacks as a result.CVE-2023-400628.8SolarWinds Platform Incomplete List of Disallowed Inputs Remote Code Execution Vulnerability. If executed, this vulnerability would allow a CVE-2023-400675.7Unchecked return value in firmware for some Intel(R) CSME may allow an unauthenticated user to potentially enable escalation of privilege vi CVE-2023-400685.4Cross-site scripting vulnerability in Advanced Custom Fields versions 6.1.0 to 6.1.7 and Advanced Custom Fields Pro versions 6.1.0 to 6.1.7 CVE-2023-400699.8OS command injection vulnerability in ELECOM wireless LAN routers allows an attacker who can access the product to execute an arbitrary OS c CVE-2023-40075.4Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.16.CVE-2023-400708.8Improper access control in some Intel(R) Power Gadget software for macOS all versions may allow an authenticated user to potentially enable CVE-2023-400717.8Improper access control in some Intel(R) GPA software installers before version 2023.3 may allow an authenticated user to potentially enable CVE-2023-400728.8OS command injection vulnerability in ELECOM wireless LAN access point devices allows an authenticated user to execute an arbitrary OS comma CVE-2023-400735.5In visitUris of Notification.java, there is a possible cross-user media read due to Confused Deputy. This could lead to local information di CVE-2023-400745.5In saveToXml of PersistableBundle.java, invalid data could lead to local persistent denial of service with no additional execution privilege CVE-2023-400755.5In forceReplaceShortcutInner of ShortcutPackage.java, there is a possible way to register unlimited packages due to a missing bounds check.