CVEvulnerability

CVE-2026-28318

7.5 HIGH Known exploited Published 2026-06-04 Modified 2026-10-21 Official page ↗

CISA Known Exploited Vulnerability

SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability — SolarWinds Serv-U

SolarWinds Serv-U contains an uncontrolled resource consumption vulnerability that allows specially crafted POST requests using the Content-Encoding: deflate header to crash the Serv-U service without authentication.

Added to KEV
2026-06-05
Remediation due
2026-06-19
Ransomware use
Unknown
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes
https://www.solarwinds.com/trust-center/security-advisories/cve-2026-28318 ; https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-5-4-hotfix-1_release_notes.htm#link7 ; https://nvd.nist.gov/vuln/detail/CVE-2026-28318
Status
Analyzed
Published
2026-06-04
Last modified
2026-10-21
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400

Description

SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate. Mitigation steps are provided to secure customer environments in the SolarWinds Trust Center if you are unable to deploy the update

Affected configurations

• solarwinds serv-u (< 15.5.4) • solarwinds serv-u 15.5.4

Related

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References