CVE-2026-28318: SolarWinds Serv-U unauthenticated denial-of-service, KEV-listed
The short version: SolarWinds Serv-U can be crashed by an unauthenticated attacker sending specially crafted POST requests (using Content-Encoding: deflate), a denial-of-service flaw tracked as CVE-2026-28318. It's in CISA's KEV catalog. The impact is availability — the service goes down, not your data — so it's serious for uptime but not a breach. Patch it, or apply SolarWinds' mitigations. Steady hands.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Moderate — availability impact only (see below) |
| CVSS v3.1 (NVD) | 7.5 — High · AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| EPSS | 10.66% · 95.3th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2026-06-19 |
| Known exploited? | Yes — CISA KEV-listed |
| Vulnerability type | CWE-400 uncontrolled resource consumption → unauthenticated denial of service (service crash) |
| Requires authenticated session? | No — pre-authentication |
| Affected | SolarWinds Serv-U (versions prior to the fixed release) |
| Fixed in | Patched Serv-U release per the SolarWinds advisory (see References) |
What you need to know
CVE-2026-28318 is an uncontrolled resource consumption flaw. A crafted, compressed POST request causes the Serv-U service to crash — no credentials required. Repeat it, and the file-transfer service stays down.
The key thing to hold steady on is what it does and doesn't do:
- It's a denial of service, not a data breach. The confidentiality and integrity of your files aren't touched by this bug; the impact is that the service stops answering.
- It's pre-authentication and network-reachable. Serv-U is meant to be exposed so people can transfer files, so the crash is triggerable by anyone who can reach it.
- It's KEV-listed. CISA has it in the Known Exploited Vulnerabilities catalog, which is why it carries a remediation deadline for federal agencies and is worth prioritizing.
How serious we see it
Moderate — and we'll say plainly why it isn't higher.
The base score is 7.5 (High) because availability impact on a network service scores that way, and KEV status earns it a place on the priority list. But our real-world take weighs the kind of impact: this crashes a service, it doesn't hand an attacker your data or a foothold. For an organization that depends on Serv-U for business file flows, an outage is a genuine problem — so this isn't "ignore it." It's a "patch it on a sensible timeline, and apply the interim mitigation if you can't patch today." The reassuring part: it's specific, fixable, and SolarWinds provides both a patch and mitigation guidance.
Recommendations
Straight from SolarWinds' advisory and CISA:
- Patch to the fixed release. Upgrade Serv-U to the version SolarWinds has patched for CVE-2026-28318.
- If you can't patch yet, mitigate. Apply the mitigation steps SolarWinds publishes in its Trust Center advisory.
- Restrict reachability. Limit access to the Serv-U service to trusted IP addresses until the patch is applied.
- Confirm your exposure first. Verify whether you run an internet-facing Serv-U instance and which build.
How BreachRisk sees it
BreachRisk discovers internet-facing Serv-U instances from little more than your domain, fingerprints the product and version, and flags exposure tied to CVE-2026-28318 — raised in priority because it's in KEV. Because verifying this one means actually crashing the service, BreachRisk does not attempt exploitation: it detects and flags the exposed, affected version rather than proving the crash, so the check itself never disrupts you.
That's the honest line — we tell you the exposed appliance is there and looks affected, and leave the disruptive proof to no one.