CISA Warns of SolarWinds Serv-U Vulnerability Exploited in Attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical SolarWinds Serv-U vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, warning that threat actors are actively exploiting the flaw in the wild.

Tracked as CVE-2026-28318, the vulnerability affects SolarWinds Serv-U file transfer software and enables unauthenticated attackers to crash the service through specially crafted HTTP requests.

CVE-2026-28318 is classified as an Uncontrolled Resource Consumption flaw (CWE-400), a vulnerability class where an application fails to properly limit the resources it allocates in response to incoming input.

In this case, an attacker can send a malicious POST request using the Content-Encoding: deflate HTTP header, forcing the Serv-U service to consume excessive resources and crash without requiring any authentication credentials.

The attack vector is particularly alarming because it requires zero privileges and can be triggered remotely over the network. This makes it an attractive initial-access vector for threat actors targeting organizations that expose Serv-U services to the internet.

CISA added CVE-2026-28318 to the KEV catalog on June 5, 2026, setting a remediation deadline of June 19, 2026 for all Federal Civilian Executive Branch (FCEB) agencies. Under Binding Operational Directive (BOD) 22-01, federal agencies are mandated to remediate KEV-listed vulnerabilities within the specified timeframe.

Whether the vulnerability has been leveraged specifically in ransomware campaigns remains unknown at this time, though CISA urges all organizations, not just federal entities, to treat this with high urgency given active exploitation in the wild.

Affected Products and Patch Availability

SolarWinds has released a hotfix addressing the vulnerability in Serv-U version 15.5.4 Hotfix 1. Organizations running any prior version of Serv-U are considered vulnerable and should apply the patch immediately.

SolarWinds published the advisory through its Trust Center, and full technical details are available via the NVD entry for CVE-2026-28318.

• Apply the SolarWinds Serv-U 15.5.4 Hotfix 1 patch immediately
• Restrict Serv-U service exposure by placing it behind a firewall or VPN where feasible
• Monitor logs for anomalous POST requests containing Content-Encoding: deflate headers
• Disable or decommission Serv-U instances if patching is not immediately possible
• Follow BOD 22-01 guidance for cloud-hosted Serv-U deployments

Security teams should consult the official SolarWinds advisory and NIST NVD entry for the latest technical details and patch guidance.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates.

The post CISA Warns of SolarWinds Serv-U Vulnerability Exploited in Attacks appeared first on Cyber Security News.