CISA Flags Exploited SolarWinds Serv-U Crash Flaw CVE-2026-28318 in KEV as a Single Deflate Header Downs File-Transfer Servers

Overview

The U.S. Cybersecurity and Infrastructure Security Agency added a denial-of-service vulnerability in SolarWinds Serv-U to its Known Exploited Vulnerabilities catalog after evidence of active exploitation, according to SecurityWeek, which reports that “CISA on Friday added the bug to its Known Exploited Vulnerabilities (KEV) catalog.” Tracked as CVE-2026-28318, the flaw lets a remote, unauthenticated attacker crash the Serv-U file-transfer service with a single specially crafted request. The U.S. National Vulnerability Database describes the issue as one in which “SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate,” per its NVD entry.

What We Know

The NVD assigns CVE-2026-28318 a CVSS 3.1 base score of 7.5, rated HIGH, with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, according to its NVD entry. That vector indicates an attack reachable over the network, requiring low complexity, no privileges, and no user interaction, with impact confined to availability — consistent with a service-crash condition that exposes no confidentiality or integrity loss. NVD classifies the weakness as CWE-400: Uncontrolled Resource Consumption and lists the entry as published on June 4, 2026.

The exploitation path is narrow and specific: as the NVD entry states, the service can be crashed by “specially crafted POST requests” that use a Content-Encoding: deflate header, with no authentication required. SolarWinds released a fix the day after the KEV listing. According to SecurityWeek, the hotfix shipped on June 6, 2026 in Serv-U version 15.5.4 Hotfix 1, and it “prevents attackers from crashing the Serv-U service via requests containing the ‘Content-Encoding: deflate’ header and some data.”

SecurityWeek reports that the affected builds enumerated by the vendor were Serv-U 15.4.2, 15.5, and 15.5.1, the last of which is end-of-life. NVD’s affected-version data covers Serv-U releases prior to 15.5.4 as well as the 15.5.4 base release, per its NVD entry.

Federal civilian agencies are under a tight remediation clock. According to SecurityWeek, “in line with Binding Operational Directive (BOD) 22-01’s requirements, CISA urged federal agencies to patch the CVE by June 19 to keep their networks protected against active threats.” CISA’s KEV catalog is reserved for vulnerabilities with confirmed exploitation in the wild.

What We Don’t Know

Who is behind the attacks remains unclear. According to SecurityWeek, “it’s unclear who is behind the attacks and whether the vulnerability has been exploited as a zero-day.” The available reporting does not identify a researcher or firm credited with discovering the flaw, the volume of observed exploitation attempts, the targeted sectors, or whether the activity is tied to any ransomware operation.

Analysis

CVE-2026-28318 is a comparatively low-stakes bug by the metrics that usually drive headlines — it leaks no data and grants no code execution, only the ability to knock a service offline, as reflected in the availability-only CVSS vector recorded by the NVD. But Serv-U is a managed file-transfer product, a category that sits at the boundary between internal networks and external partners and has repeatedly drawn attacker interest. A crash that requires no credentials, no user interaction, and only a single crafted HTTP header lowers the bar for disruption to near zero, and the gap of barely two days between the June 4 NVD publication and the June 6 hotfix underscores how quickly defenders are expected to move once active exploitation is confirmed. For organizations still running affected builds — including the end-of-life 15.5.1 release flagged by SecurityWeek — applying Serv-U 15.5.4 Hotfix 1 ahead of the June 19 federal deadline is the clear remediation path.