CVE-2026-28318highunder attackCWE-400

CVE-2026-28318: high-severity vulnerability in SolarWinds Serv-U

SolarWinds Serv-U Unauthenticated Denial of Service Vulnerability

Published · Updated

71Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 7.5epss 1.9%
from disclosure to weapon5 days
Published on NVDJun 4
1st PoC+5d
CISA KEV+1d
exploitation probability
1.9%top 20% of all CVEs
observed exploitation
yesCISA + VulnCheck
4 public exploit(s)
Action required by CISAfederal deadline: 2026-06-19

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

SolarWinds Serv-U can be crashed by anyone sending specially crafted requests without logging in. This disrupts the file transfer service for all users until it restarts.

Technical detail

Unauthenticated attackers can exploit improper input handling in POST request processing with Content-Encoding: deflate to trigger a denial of service condition, crashing the Serv-U service without requiring credentials or prior access.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate. Mitigation steps are provided to secure customer environments in the SolarWinds Trust Center if you are unable to deploy the update
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
SolarWinds · Serv-U
public PoCs found — 4
githubgithub.com/EaEa0001/servu-cve-2026-28318-poc★ 1githubgithub.com/BishopFox/CVE-2026-28318-check★ 1githubgithub.com/jenniferreire26/CVE-2026-28318★ 0vulncheckvulncheck.com/xdb/d35409cf284eunverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — SolarWinds Serv-U

In the same product, most dangerous first.

CVE-2021-35247MEDIUMImproper Input Validation Vulnerability in Serv-UEPSS 3.5%KEVCVE-2021-35250HIGHDirectory Transversal Vulnerability in Serv-U 15.3EPSS 12.8%CVE-2024-45711HIGHSolarWinds Serv-U FTP Service Directory Traversal Remote Code Execution VulnerabilityEPSS 6.3%CVE-2021-35223HIGHExecute Command Function Allows Remote Code Execution (RCE)VulnerabilityEPSS 2.9%CVE-2026-28316CRITICALSolarWinds Serv-U Insecure Direct Object Reference (IDOR) VulnerabilityEPSS 2.1%CVE-2025-40549CRITICALSolarWinds Serv-U Path Restriction Bypass VulnerabilityEPSS 1.1%
References
https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-5-4-hotfix-1_release_notes.htmhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-28318https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28318