CVE-2026-28318: SolarWinds Serv-U unauthenticated POST request denial of service

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityUnauthenticated remote denial of service with CISA KEV listing and high EPSS, though impact is limited to availability.

What it is

SolarWinds Serv-U crashes when it receives a specially crafted POST request using Content-Encoding: deflate, and the crash occurs without authentication. The flaw is an uncontrolled resource consumption issue (CWE-400) that lets an unauthenticated remote party take the service down. SolarWinds has published a hotfix and mitigation guidance for environments that cannot update immediately.

Impact

An attacker can crash the Serv-U service, causing a denial of service for file transfer operations. There is no confidentiality or integrity impact per the CVSS vector; the effect is availability loss only.

Attack surface

The flaw is reachable over the network via HTTP POST requests to the Serv-U service, with no authentication and no user interaction required (AV:N/AC:L/PR:N/UI:N). Any host that can reach the Serv-U listener can attempt it.

Exploitation

CVE-2026-28318 was added to CISA KEV on 2026-06-05 with a 2026-06-19 remediation due date, indicating known exploitation in the wild. EPSS is 0.40012 (98.6th percentile), and no ransomware campaign use is documented.

What to do

• Apply the SolarWinds Serv-U 15.5.4 Hotfix 1 update or later as the primary fix.
• If patching is not possible, apply the mitigation steps in the SolarWinds Trust Center advisory for CVE-2026-28318.
• Restrict network access to the Serv-U service to trusted hosts and networks only.
• Follow BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
• Monitor for and block POST requests carrying Content-Encoding: deflate where they are not expected.

Detection

• Alert on Serv-U service crashes or unexpected restarts and correlate with inbound POST traffic.
• Search web or proxy logs for POST requests to Serv-U endpoints with a Content-Encoding: deflate header.
• Baseline normal Serv-U request volume and flag spikes or repeated malformed POST attempts from single sources.
• Review Serv-U and host logs for availability gaps matching the KEV remediation window.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.