CVE-2026-28318
SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability
Description
CVE-2026-28318 is an uncontrolled resource consumption (denial of service) vulnerability in SolarWinds Serv-U. By sending specially crafted POST requests that use a Content-Encoding: deflate header, an unauthenticated attacker can crash the Serv-U service remotely, taking the file transfer server offline. The flaw matters because CISA has added CVE-2026-28318 to its Known Exploited Vulnerabilities (KEV) catalog, confirming the SolarWinds Serv-U issue is being actively exploited in the wild. Although the EPSS score is low, the KEV listing makes patching this Serv-U denial of service vulnerability a priority for any internet-facing deployment.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| solarwinds | serv-u | < 15.5.4; 15.5.4 |
References
- https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-5-4-hotfix-1_release_notes.htm(Release Notes)
- https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28318(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-28318(US Government Resource)
Weakness Type
CWE-400: Uncontrolled Resource Consumption
In CVE-2026-28318, SolarWinds Serv-U fails to properly limit the resources consumed while processing a crafted, deflate-encoded POST request, allowing an attacker to exhaust service resources and crash the process. This uncontrolled allocation results in a denial of service against the Serv-U file transfer server.
Learn more: CWE-400 — Uncontrolled Resource Consumption
Impact Analysis
This vulnerability carries a CVSS 3.1 base score of 7.5 (HIGH). It is Remotely Exploitable (AV:N): an attacker can reach the service over the network without any prior access, and it is Low Complexity (AC:L): the attack is easy to carry out reliably. It requires No Authentication (PR:N): no credentials are needed, and No User Interaction (UI:N): no victim action is required, making it well suited for opportunistic, automated attacks. The impact is Contained (S:U) to the Serv-U component, with No Confidentiality (C:N) and No Integrity (I:N) impact, but Availability (High): a successful attack crashes the Serv-U service and disrupts all file transfer operations until the process recovers.
Exploit Maturity
CISA has confirmed active exploitation in the wild by adding CVE-2026-28318 to its Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is 0.00062 (19.65th percentile), which represents a low predicted probability of exploitation over the next 30 days, but this statistical estimate is outweighed by the confirmed real-world activity reflected in the KEV listing. No public exploit code is tagged in the available references, so none appears to be currently published, yet the KEV listing means this vulnerability should be treated as actively targeted. There is no known ransomware association.
Remediation
- Follow the CISA KEV action: "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable." The KEV due date is 2026-06-19.
- Apply the vendor fix: Upgrade SolarWinds Serv-U to version 15.5.4 Hotfix 1, which resolves the vulnerability per the SolarWinds release notes.
- Apply interim mitigations if you cannot patch immediately: Follow the mitigation steps published in the SolarWinds Trust Center. Restrict and filter inbound POST requests to Serv-U, apply rate limiting, and block crafted
Content-Encoding: deflatepayloads at a WAF or reverse proxy in front of the service. - Monitor for exploitation: Watch for unexpected Serv-U service crashes or restarts and for anomalous or high-volume POST requests, especially those using
Content-Encoding: deflate. - Harden against resource exhaustion long term: In line with the CWE-400 guidance, enforce strict per-user, per-session, and per-request resource limits, configure connection and request timeouts, and apply rate limiting to prevent any single client from exhausting service resources.
Technical Details
The vulnerability stems from how SolarWinds Serv-U processes crafted, deflate-encoded request bodies. An unauthenticated attacker sends a specially crafted POST request with a Content-Encoding: deflate header, which triggers uncontrolled resource consumption while the service decodes and handles the payload, ultimately crashing the Serv-U service and causing a denial of service. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects an attack that is reachable over the network with low complexity, requires no privileges and no user interaction, and is limited to an availability-only impact. Because no authentication is needed, any reachable Serv-U instance can be crashed remotely. The result is loss of availability for all file transfer functions until the service is restored.
Frequently Asked Questions
Is CVE-2026-28318 being actively exploited?
Yes. CISA has added CVE-2026-28318 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. The EPSS probability is low (0.00062, 19.65th percentile), but the KEV listing means it should be treated as actively targeted. There is no known ransomware association.
What products are affected by CVE-2026-28318?
SolarWinds Serv-U versions before 15.5.4 are affected, and version 15.5.4 is also listed as affected. The issue is fixed in Serv-U 15.5.4 Hotfix 1.
How do I fix CVE-2026-28318?
Upgrade SolarWinds Serv-U to 15.5.4 Hotfix 1 as described in the vendor release notes. If you cannot patch immediately, apply the mitigations from the SolarWinds Trust Center, such as filtering inbound POST requests and blocking crafted Content-Encoding: deflate payloads at a WAF or reverse proxy.
How severe is CVE-2026-28318?
It is rated HIGH with a CVSS 3.1 base score of 7.5. An unauthenticated remote attacker can crash the Serv-U service, causing a denial of service, though there is no impact to data confidentiality or integrity.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.