CVE-2026-28318: exploited SolarWinds Serv-U DoS flaw

CVE-2026-28318 is a denial-of-service vulnerability in SolarWinds Serv-U. An unauthenticated attacker can send a crafted POST request with Content-Encoding: deflate and crash the service. It has a CVSS 7.5 score and appears in CISA’s Known Exploited Vulnerabilities catalogue.

The confirmed impact is loss of service availability, not remote code execution or theft of stored files. DoS can still disrupt critical business processes, but response should remain based on the vendor’s documented effect.

How the problem works

The Serv-U 15.5.4 Hotfix 1 release notes state that a crafted unauthenticated POST request can crash the Serv-U process. The trigger involves compressed content marked with Content-Encoding: deflate.

The attacker needs network access to the vulnerable component but no account. Successful exploitation interrupts file transfers and can keep the service unavailable through repeated requests. CVSS 7.5 reflects high availability impact without confirmed confidentiality or integrity impact. CISA KEV raises priority because exploitation evidence exists.

Affected and fixed versions

Versions earlier than Serv-U 15.5.4 Hotfix 1 are affected. This includes base 15.5.4 without Hotfix 1. A scanner that records only 15.5.4 may incorrectly treat the host as fixed.

The SolarWinds advisory identifies 15.5.4 Hotfix 1 as the remediation. The hotfix can be applied only to base 15.5.4, so older installations must first move to that release.

Business impact

Serv-U frequently supports automated file exchange with customers and partners. A crash can stop document transfer, downstream ingestion and time-sensitive workflows. Automatic process restart may shorten an outage, but an attacker can trigger it again.

The vulnerability does not by itself prove access to files. Any confidentiality or integrity signals require separate investigation for another vulnerability, configuration problem or stolen credentials.

Safe deployment steps

1. Find every Serv-U instance, including backups and partner-managed systems.
2. Verify the full version and hotfix level.
3. Upgrade older branches to 15.5.4 where required.
4. Follow the Windows or Linux file-backup and process-stop procedure in the release notes.
5. Apply Hotfix 1, restart and confirm the complete version.
6. Run controlled file-transfer tests and monitor queues, failures and service stability.

Automatic restart is not remediation. If deployment must wait, apply the vendor’s documented temporary steps, restrict network access to required sources and alert on crashes, restart loops and unusual HTTP requests. Preserve diagnostic data before restart where possible.

CVE-2026-28318 is not an RCE according to SolarWinds, but it can stop Serv-U without authentication and is actively exploited. Verify Hotfix 1 explicitly rather than relying on the base product number.

Sources: SolarWinds release notes, SolarWinds advisory, CISA KEV.