CVE-2026-28318
SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability
Published Jun 4, 2026 · updated Jul 22, 2026 · SolarWinds Serv-U
SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate. Mitigation steps are provided to secure customer environments in the SolarWinds Trust Center if you are unable to deploy the update
Timeline
Detection, updates, and resolution for this record.
Jun 4, 2026 · Catalog
Detected
SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate. Mitigation steps are provided to secure customer environments in the SolarWinds Trust Center if you are unable to deploy the update
Jun 5, 2026 · CISA KEV
Known exploited
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Jun 19, 2026 · CISA KEV
Remediation due
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Jul 22, 2026 · Catalog
Updated
SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate. Mitigation steps are provided to secure customer environments in the SolarWinds Trust Center if you are unable to deploy the update
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA due date Jun 19, 2026
Affected
- cpe solarwinds/serv-uversion unspecified
- cpe solarwinds/serv-u15.5.4
- vendor SolarWinds Serv-Uversion unspecified
Sources
- CISA KEVCVE-2026-28318
SolarWinds Serv-U contains an uncontrolled resource consumption vulnerability that allows specially crafted POST requests using the Content-Encoding: deflate header to crash the Serv-U service without authentication.
cisa.gov - CVE.orgCVE-2026-28318
Official CVE identifier
cve.org - FIRST EPSSCVE-2026-28318
30-day exploitation probability 1.9%
first.org - NIST NVDCVE-2026-28318
SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate. Mitigation steps are provided to secure customer environments in the SolarWinds Trust Center if you are unable to deploy the u
nvd.nist.gov