CVE-2026-28318: SolarWinds Serv-U Unauthenticated Denial-of-Service Vulnerability

Technical summary

CVE-2026-28318 is a CWE-400 (Uncontrolled Resource Consumption) flaw in SolarWinds Serv-U triggered via malformed POST requests that specify Content-Encoding: deflate. The vulnerability bypasses authentication requirements and results in denial of service to the Serv-U process. The CVSS 3.1 score of 7.5 (HIGH) reflects network accessibility, low attack complexity, no privilege requirement, and high availability impact with no confidentiality or integrity compromise.

Business impact

Service disruption to file transfer and remote access operations represents the primary risk. Organizations relying on Serv-U for managed file transfer or secure shell access face availability losses during an active denial-of-service condition. Recovery requires manual service restart. Unlike exploits that exfiltrate data, this threat model targets operational continuity; however, repeated or sustained attacks could degrade customer-facing SLA compliance and require incident response overhead.

Affected systems

SolarWinds Serv-U installations are affected. Confirm your specific version against the vendor's patched releases via the SolarWinds Trust Center advisory. Both client and server deployments of Serv-U may be vulnerable; verification of your deployed version is essential before assuming exposure or immunity.

Exploitability

The vulnerability is highly exploitable in practice. Attack requires only network access and no authentication, making it trivial to weaponize from any vantage point that can reach the Serv-U service port. The low attack complexity and absence of user interaction mean automated scanning and exploitation are feasible. The vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) catalog on 2026-06-05, indicating active exploitation in the wild and the likely availability of functional proof-of-concept code.

Remediation

Apply the SolarWinds security update for Serv-U as advised in the vendor advisory. Organizations unable to patch immediately should implement network segmentation to restrict access to Serv-U administrative and service ports, limit POST requests from untrusted origins, or temporarily disable the service if operationally feasible. Review the SolarWinds Trust Center for detailed mitigation steps tailored to your deployment model.

Patch guidance

Obtain the patched Serv-U build from SolarWinds' official release channels and security advisory. Verify patch applicability to your current version before deployment. Test patches in a non-production environment to confirm compatibility with your file transfer workflows and integrations. The CISA KEV due date of 2026-06-19 establishes a deadline for federal agencies and critical infrastructure; other organizations should prioritize patching within one to two weeks of publication.

Detection guidance

Monitor Serv-U logs and service health dashboards for unexpected restarts or crashes correlating with POST request spikes. Implement network-based detection for malformed Content-Encoding: deflate headers directed at Serv-U ports. Alert on repeated failed or crash-triggering requests from suspicious sources. Correlate process termination events with incoming network traffic patterns to identify potential attack attempts. Review firewall and reverse-proxy logs for anomalous POST request payloads.

Why prioritize this

This vulnerability warrants immediate attention due to its HIGH CVSS score, presence in the CISA KEV catalog indicating active exploitation, unauthenticated attack surface, and direct impact on service availability. The combination of trivial exploitability and operational consequences—especially for organizations using Serv-U as a critical file transfer backbone—demands rapid patch deployment or compensating controls within the CISA due date window.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects the threat model: network-accessible, no authentication required, low attack complexity, and high availability impact. The absence of confidentiality or integrity compromise prevents a critical rating, but the uncontrolled resource consumption nature of the flaw and its proven real-world exploitation justify the HIGH severity classification. Organizations with Serv-U exposed to the internet or untrusted networks face acute risk.

Frequently asked questions