CISA Adds Actively Exploited SolarWinds Serv
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-28318 | Unauthenticated DoS in SolarWinds Serv-U via crafted Content-Encoding: deflate POSTs SolarWinds Serv-U, an FTP and managed-file-transfer server, contains an uncontrolled resource consumption flaw (CWE-400) that allows an unauthenticated remote attacker to exhaust the service's resources. It is triggered by sending specially crafted POST requests with the Content-Encoding: deflate header, which crashes the Serv-U service. An attacker gains denial of service — file transfer operations stop until the service is restarted — and the available data indicates no remote code execution or data exposure. Any organization running Serv-U, typically enterprises using it as an internal or internet-facing file transfer endpoint, is affected; the available advisories do not specify affected version ranges. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-06-05, signaling exploitation in the wild, and EPSS estimates a 40% probability of exploitation within 30 days (99th percentile), though CVSS scoring is pending and no public proof-of-concept is known. Do: Inventory all Serv-U deployments and apply SolarWinds' mitigation per vendor instructions, or discontinue use of the product if mitigations are unavailable, as required by the KEV listing (federal agencies must follow BOD 22-01 timelines). As an interim mitigation, block or normalize POST requests carrying the Content-Encoding: deflate header at a WAF or reverse proxy and restrict Serv-U's internet exposure. Monitor the Serv-U service for crashes, since successful exploitation takes it down until it is restarted. | 7.5 | 40% | KEV |
| moderate≈tens of thousands of installations; only a few thousand Serv-U servers exposed to the internet |
Full article238 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananJun 06, 2026Vulnerability / Patch Management
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity security flaw impacting SolarWinds Serv-U multi-protocol file server software to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.
The vulnerability, tracked as CVE-2026-28318 (CVSS score: 7.5), is a denial-of-service (DoS) bug that causes the service to crash under certain conditions. CISA described it as an uncontrolled resource consumption vulnerability that results in a DoS condition.
"SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate," SolarWinds said in an advisory released earlier this week.
The issue has been addressed in SolarWinds Serv-U version 15.5.4 HF1. As mitigations, it's advised to limit access to known addresses and block any request containing "content-encoding" since the vulnerable service does not require this functionality.
There are currently no details on how the vulnerability is being exploited in real-world attacks, or who is behind them. It's also unclear how many internet-exposed Serv-U instances are compromised, if any.
CISA has ordered Federal Civilian Executive Branch (FCEB) agencies to address the flaw by June 19, 2026. In the past, multiple flaws in Serv-U have been exploited by bad actors, including those associated with the Cl0p ransomware gang.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/06/cisa-adds-actively-exploited-solarwinds.html