CISA: Patch actively exploited SolarWinds Serv-U DoS vulnerability (CVE-2026-28318)
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-35211 | Unauthenticated RCE (Remote Memory Escape) in SolarWinds Serv-U | 10.0 | 91% | KEVRansomware | KEV |
| CVE-2021-35247 | Actively Exploited Input Validation Flaw in SolarWinds Serv-U LDAP Login | 5.3 | 3% | KEV | KEV |
| CVE-2024-28995 | Unauthenticated Path Traversal File-Read in SolarWinds Serv-U | 7.5 | 100% | KEV | KEV |
| CVE-2026-28318 | Unauthenticated DoS in SolarWinds Serv-U via crafted Content-Encoding: deflate POSTs | 7.5 | 44% | KEV | KEV |
From the original article
2 min read at helpnetsecurity.com
A vulnerability (CVE-2026-28318) that can be exploited to crash SolarWinds Serv-U file transfer servers is being leveraged by attackers in the wild, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed on Friday. The agency has ordered US federal civilian agencies to address it by June 19, 2026, either by implementing a patch or implementing mitigations.
By @zeljkazorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.