The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-28318 to its Known Exploited Vulnerabilities (KEV) catalog after confirming that threat actors are actively targeting a high-severity flaw in SolarWinds Serv-U to remotely crash file transfer servers without requiring authentication.
The flaw CVE-2026-28318 is classified as an uncontrolled resource consumption flaw (CWE-400) in SolarWinds Serv-U, the company’s widely deployed Windows and Linux file transfer software that supports MFT, FTP, FTPS, SFTP, and HTTP/HTTPS protocols.
An unauthenticated attacker can trigger a denial-of-service condition by sending a specially crafted HTTP POST request with the Content-Encoding: deflate header.
SolarWinds Serv-U Vulnerability Exploited
The malformed compressed payload forces the Serv-U service to exhaust system resources during decompression, causing it to crash without any user interaction or elevated privileges.
The vulnerability carries a high availability impact, with no direct confidentiality or integrity compromise per its CVSS vector, but in operational reality, crashing business-critical file-transfer infrastructure can disrupt payroll exports, compliance workflows, partner data exchanges, and automated transfer jobs.
SolarWinds released Serv-U 15.5.4 Hotfix 1 specifically to address this vulnerability. According to Shodan, over 12,000 Serv-U servers are currently exposed online, while Shadowserver tracks approximately 3,100, with no confirmed count on how many remain unpatched.
Affected versions include all releases before 15.5.4, as well as Serv-U 15.5.4 instances that have not yet applied the hotfix. Administrators who upgraded to 15.5.4 but skipped the hotfix remain vulnerable, a critical distinction that patch inventory tools may miss.
CISA added CVE-2026-28318 to the KEV catalog on June 5, 2026, setting a remediation deadline of June 19, 2026, for all Federal Civilian Executive Branch (FCEB) agencies under Binding Operational Directive (BOD) 22-01.
While the directive legally applies only to federal agencies, CISA urged all private-sector defenders to treat the listing as an immediate signal for prioritization.
“This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise,” CISA stated.
Serv-U has been a persistent high-value target. The Clop ransomware gang previously exploited CVE-2021-35211, a Serv-U RCE flaw, to breach corporate networks in 2021.
Chinese state-sponsored threat group DEV-0322 also weaponized the same flaw in zero-day attacks. In June 2024, GreyNoise and Rapid7 flagged active exploitation of a Serv-U path traversal bug, CVE-2024-28995.
CISA has now cataloged 11 vulnerabilities across SolarWinds products as actively exploited, underscoring the platform’s sustained targeting by both cybercrime and nation-state actors.
Mitigations
Organizations should take the following immediate steps:
- Apply SolarWinds Serv-U 15.5.4 Hotfix 1 to verify the exact build from within the application, not from package inventory
- Block POST requests containing
content-encodingheaders at the WAF or reverse proxy layer as a temporary compensating control - Audit all Serv-U instances across DMZs, subsidiaries, DR nodes, and vendor-managed environments, not just primary deployments
- Follow BOD 22-01 guidance for cloud-hosted Serv-U; discontinue use if patching is not feasible
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
 has added a critical SolarWinds Serv-U vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, warning federal agencies and private organizations to apply patches immediately.){kind=link}