CVE-2026-28318: SolarWinds Serv-U Flaw Now Exploited

CISA added CVE-2026-28318, a SolarWinds Serv-U denial-of-service flaw, to its Known Exploited Vulnerabilities catalog on June 5, 2026 after confirming active exploitation. An unauthenticated attacker can crash the file-transfer service with a crafted HTTP request. SolarWinds fixed it in Serv-U 15.5.4 Hotfix 1; federal agencies must patch by June 19.

File-transfer servers are quiet infrastructure. Most companies set them up once, point a few partners and internal teams at them, and forget they exist. That is exactly why the latest SolarWinds Serv-U advisory deserves a second look — a flaw in software that almost nobody thinks about daily is now being used in real attacks.

What is CVE-2026-28318 and why did CISA flag it?

CVE-2026-28318 is a high-severity denial-of-service vulnerability in SolarWinds Serv-U, the company's self-hosted file-transfer software. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities (KEV) catalog on June 5, 2026 after confirming attackers were using it in the wild. It carries a CVSS score of 7.5.

The technical root cause is what the security community calls CWE-400, or uncontrolled resource consumption. According to Help Net Security, the flaw lives in how Serv-U handles HTTP POST requests that carry the Content-Encoding: deflate header. A remote, unauthenticated attacker can send a crafted request that forces the service to burn through system resources and crash — no login, no user interaction, low complexity.

In its own advisory, SolarWinds described the issue plainly: “SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate.” The company disclosed the bug on June 3 alongside the release of Serv-U 15.5.4 Hotfix 1.

Why does a 'crash' bug matter to a business?

A denial-of-service flaw doesn't steal data or plant ransomware on its own, so it's easy to wave off as low-priority. That instinct is wrong here. The thing on the KEV catalog isn't theoretical risk — it's observed, in-the-wild exploitation, and CISA only lists vulnerabilities once it has evidence attackers are actually using them.

Serv-U matters because of who runs it. As Help Net Security notes, it's often deployed by organizations in regulated sectors such as healthcare and financial services to move sensitive files. When that service goes down, partner data exchanges stall, automated workflows break, and — depending on contracts — availability SLAs start getting violated.

There's a second reason a vCISO treats an availability bug seriously: disruption is rarely the whole story. A crashed service is noise. While defenders are busy restarting Serv-U and chasing the outage, that same window is useful cover for credential testing, lateral movement, or reconnaissance elsewhere on the network. Treating the crash as an isolated annoyance is how the real intrusion gets missed.

How are attackers exploiting the Serv-U flaw?

Attackers trigger the flaw remotely, without any credentials, by sending a malformed compressed payload over HTTP. BleepingComputer reports the attacks are low-complexity and require no user interaction — meaning any internet-facing Serv-U instance is reachable by anyone who can send it a web request.

CISA and SolarWinds have not published details on who is behind the activity or whether it's tied to a ransomware operation. That gap shouldn't be read as reassurance. Serv-U has a long history as a high-value target.

According to Help Net Security, a 2021 Serv-U remote code execution flaw (CVE-2021-35211) was exploited as a zero-day by suspected Chinese state actors for espionage, and later picked up by the Clop ransomware group. A separate Serv-U issue was leveraged in Log4j-related attacks, and a “trivially exploitable” flaw was abused again two years ago. The pattern is consistent: when a Serv-U bug surfaces, capable actors move on it quickly.

What should your business do before June 19?

The fastest fix is to upgrade to Serv-U 15.5.4 Hotfix 1, which SolarWinds released on June 3. CISA set a remediation deadline of June 19, 2026 for federal civilian agencies under Binding Operational Directive (BOD) 22-01. That directive legally binds federal agencies only — but it's a sensible deadline for everyone else to borrow.

One detail trips up a lot of asset inventories: this is a hotfix, not a clean version bump. Being on the 15.5.x branch is not the same as being patched. You have to verify the exact build and hotfix state on each box, because a procurement spreadsheet showing “15.5.4” can still be vulnerable.

If you can't deploy the hotfix immediately, SolarWinds' interim guidance — echoed by BleepingComputer — is to restrict access to known addresses and block any request carrying the content-encoding header, since the service doesn't actually need it. A practitioner take to add on top of that: if a Serv-U instance is sitting on the open internet with no business reason to be, the KEV listing is your cue to question the exposure itself, not just patch around it.

The broader decision rule is simple. Exposed file-transfer software belongs in the same priority tier as VPNs, firewalls, and identity systems — the internet-facing controls attackers probe first. If you're a regulated business and you've been treating Serv-U as set-and-forget plumbing, this is the moment to fold it into your real patch cadence. This is the kind of prioritization call a fractional CISO makes routinely: which of today's advisories actually changes what you do this week, and which don't.

Frequently asked questions

Does the June 19 deadline apply to private companies?

No — the June 19, 2026 deadline under BOD 22-01 is legally binding only on U.S. federal civilian agencies. That said, CISA explicitly urged all organizations to treat active exploitation as a high-priority signal. For a private business, the KEV listing is a strong prioritization cue even though it isn't a legal mandate.

How do I know if my Serv-U install is actually patched?

Check the precise build and confirm Serv-U 15.5.4 Hotfix 1 is applied — not just that you're on the 15.5.x branch. Because the fix shipped as a hotfix rather than a full version, an instance can report 15.5.4 and still be vulnerable. Verify the hotfix state on each server, not the version number in an asset list.

Is CVE-2026-28318 being used in ransomware attacks?

As of publication, neither CISA nor SolarWinds has linked CVE-2026-28318 to a specific actor or ransomware campaign. The exploitation is confirmed but unattributed. Given that an earlier Serv-U flaw was eventually adopted by the Clop ransomware group, the absence of attribution today is not a reason to delay patching.

We only use Serv-U internally. Are we still at risk?

Your exposure drops sharply if the service isn't reachable from the internet. The attack requires sending a crafted HTTP request to the Serv-U service, so an instance restricted to internal, trusted addresses is far harder to reach. Confirm it truly isn't internet-facing, then apply the hotfix on your normal cycle.

Not sure whether your file-transfer servers are on the open internet, or whether “patched” in your asset inventory actually means patched? That's the kind of question worth answering before an outage forces it. Purple Shield Security works with regulated and mid-market businesses as an independent, vendor-neutral vCISO — no tool resale, no kickbacks, just a straight read on what to fix first.

By Yonatan Hoorizadeh — CISSP, CISM, CRISC, AAISM

Published By: Purple Shield Security

Published: June 9, 2026

Last updated: June 9, 2026