Skip to content

SolarWinds Serv-U CVE-2026-28318 exploitation

Summary

CVE-2026-28318 is an unauthenticated denial-of-service vulnerability in SolarWinds Serv-U. SolarWinds says specially crafted HTTP POST requests with Content-Encoding: deflate can crash the Serv-U service, and CISA added the flaw to the Known Exploited Vulnerabilities catalog on June 5, 2026.

The durable threat-intelligence value is not code execution; it is availability pressure against exposed managed-file-transfer infrastructure. A low-complexity unauthenticated crash primitive can disrupt file-transfer operations, mask other activity, or become a repeated outage path while defenders are handling other edge-service risk.

Tags

Why this matters

  • Serv-U is commonly deployed as internet-facing file-transfer infrastructure, making even availability-only bugs operationally disruptive.
  • The vulnerable request is unauthenticated and network reachable; public sources reviewed here do not require user interaction or prior access.
  • CISA KEV inclusion confirms known exploitation and sets a June 19, 2026 remediation due date for covered federal agencies.
  • A crash loop against file-transfer infrastructure can interrupt business processes and may obscure concurrent credential, web-shell, or data-staging investigations.

Operational characteristics

  • Affected product: SolarWinds Serv-U 15.5.4 and below.
  • Fixed release: SolarWinds Serv-U 15.5.4 HF1.
  • Exploit primitive: unauthenticated HTTP POST request using a Content-Encoding: deflate header that can crash the Serv-U service.
  • Impact: availability only in public scoring reviewed here; SolarWinds' CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
  • CWE: CISA and NVD list CWE-400, uncontrolled resource consumption.
  • Known exploitation: CISA added the CVE to KEV on June 5, 2026; the KEV entry lists known ransomware campaign use as unknown.
  • Attribution: no public actor or malware attribution was identified in the reviewed CISA, NVD, or SolarWinds sources.

Defender heuristics

  • Inventory externally reachable Serv-U hosts and prioritize upgrade to 15.5.4 HF1.
  • If upgrade cannot happen immediately, follow SolarWinds' compensating controls: limit access to known addresses where possible and block POST requests containing a Content-Encoding header value of deflate at a WAF, reverse proxy, or edge filter.
  • Review web access logs, reverse-proxy logs, WAF logs, and Serv-U service restart/crash telemetry for unauthenticated POST requests with Content-Encoding: deflate.
  • Preserve outage and access logs before restarting or patching if repeated crashes occurred; availability attacks against managed-file-transfer services can coincide with credential guessing, path probing, or data-staging attempts.
  • Treat confirmed exploitation as an edge-service incident: validate exposed accounts, recent file-transfer activity, administrative logins, configuration changes, and unexpected inbound source patterns even if the CVE itself is scored as denial of service.

September 19, 2026 follow-up: SolarWinds September advisory batch, Access Rights Manager hard-coded-key RCE (CVE-2026-28326) plus 16 Serv-U fixes

SolarWinds released a September 17, 2026 advisory batch (The Hacker News, Sep 19, 2026):

  • CVE-2026-28326, Access Rights Manager (ARM), CVSS 8.8, unauthenticated RCE stemming from a HARD-CODED STATIC KEY, affecting ALL versions of ARM 2026.2 and prior; patched in ARM 2026.2.1; credited to Armadin researcher Kai Huang; no known exploitation as of coverage. The durable read is the failure class, not the score: ARM is an identity/permission-management product for AD/M365 environments, so a hard-coded cryptographic key turns its network-facing surface into an unauthenticated code-execution path INTO the identity-permission layer, same "hard-coded secret shipped to every customer install" family as this wiki's SolarWinds WHD SAML-bypass (CVE-2026-28323, 9.8, fixed in WHD 2026.2.1 in the same batch window) and the standing pattern that product key material is a fleet-wide single point of failure. Hunt: internet-exposed ARM instances (management UI is not supposed to be public), and treat any ARM host as compromised-until-proven-otherwise if it could not be patched before the disclosure went public.
  • Serv-U: 16 flaws fixed (CVE-2026-28302, CVE-2026-28304 through CVE-2026-28317, CVE-2026-28321, CVE-2026-28323) spanning privilege escalation, remote code execution, and administrator-account creation, a materially worse profile than this page's DoS-only CVE-2026-28318. Any Serv-U host still deferring the June hotfix should now be evaluated against this larger patch surface; admin-account creation on a managed file-transfer server is post-compromise persistence made product-sized.
  • Sequencing note: this is SolarWinds' second advisory batch touching the same products in ~two months (August: WHD 9.8 SAML bypass + DoS; September: ARM key RCE + 16 Serv-U CVEs), and Serv-U now carries both a KEV-listed availability bug (this page) and fresh unpatched-else RCE/privesc CVEs, treat un-patched Serv-U/ARM/WHD as one risk cluster.

Sources