CVE-2026-28318

SolarWinds Serv-U

Published 4 Jun 2026 · updated 22 Jul 2026 · Analyzed

7.5 High · CVSS 3.1, solarwinds.com

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 5 Jun 2026, with a remediation deadline of 19 Jun 2026 for US federal agencies.

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Description

SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate. Mitigation steps are provided to secure customer environments in the SolarWinds Trust Center if you are unable to deploy the update

References

documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-5-4-hotfix-1_release_notes.htm · Release Notes
www.solarwinds.com/trust-center/security-advisories/CVE-2026-28318 · Vendor Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-28318 · US Government Resource