CVE-2026-28318
SolarWinds Serv-U Unauthenticated Denial of Service Vulnerability
SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA notes
https://www.solarwinds.com/trust-center/security-advisories/cve-2026-28318 ; https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-5-4-hotfix-1_release_notes.htm#link7 ; https://nvd.nist.gov/vuln/detail/CVE-2026-28318
Description
SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate. Mitigation steps are provided to secure customer environments in the SolarWinds Trust Center if you are unable to deploy the update
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HAffected Products
| Vendor | Product | Affected versions |
|---|---|---|
| SolarWinds | Serv-U | 15.5.4 and previous versions |
References
2 LinksRecord Details
More from SolarWinds
SolarWinds Serv-U L Directory Transversal Vulnerability
SolarWinds Web Help Desk Hardcoded Credential Vulnerability
SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands
Serv-U Remote Memory Escape Vulnerability
Related Tool Categories
Tool categories that test for or protect against this vulnerability class.
CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.