Actively exploited · Published Jun 4, 2026 · Assigned by SolarWinds
CVE-2026-28318SolarWinds Serv-U Unauthenticated Denial of Service Vulnerability
High 7.5 Exploited
In plain English
A high-severity uncontrolled resource consumption in Serv-U from SolarWinds. Attackers are actively exploiting it in the wild (listed by CISA on June 5, 2026). The chance it is exploited in the next 30 days is estimated at 43.7% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Jun 19, 2026.
Official description
SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate. Mitigation steps are provided to secure customer environments in the SolarWinds Trust Center if you are unable to deploy the update
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SolarWinds | Serv-U | 0 – through 15.5.4 |
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28318
- https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-5-4-hotfix-1_release_notes.htm
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-28318 government-resource