CVE-2026-28318: SolarWinds Serv-U Unauthenticated Deflate DoS (KEV)
CVE-2026-28318 is an uncontrolled resource consumption bug (CWE-400) in SolarWinds Serv-U: a remote, unauthenticated attacker can send a specially crafted HTTP POST request with a Content-Encoding: deflate header to crash the Serv-U service, and CISA added it to the Known Exploited Vulnerabilities catalog days after disclosure.
Vulnerability summary
| Vulnerability ID | CVE-2026-28318 |
|---|---|
| CVSS score | 7.5 |
| EPSS score | 0.4365 |
| CISA KEV | Yes — in the Known Exploited Vulnerabilities catalog |
| Source | NVD |
| Published | 2026-06-04T15:16:50.407 |
Affected components
| Component | CPE | Version range |
|---|---|---|
| SolarWinds Serv-U | cpe:2.3:a:solarwinds:serv-u:*:*:*:*:*:*:*:* | 15.5.4 and all earlier releases (fixed in 15.5.4 Hotfix 1) |
What this means
CVE-2026-28318 affects SolarWinds Serv-U, a managed file-transfer server. NVD's description states Serv-U "is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate" (NVD).
SolarWinds' own CNA submission, which NVD stores as a Secondary (not NVD-confirmed) metric, scores this CVSS v3.1 7.5 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H — network-reachable, low attack complexity, no privileges or user interaction required, with high impact to availability only (a denial-of-service, not data exposure or code execution). CWE-400 (Uncontrolled Resource Consumption) is the assigned weakness (NVD).
SolarWinds' Trust Center advisory confirms the summary and adds interim mitigation for sites that cannot patch immediately: block any POST request containing a Content-Encoding header at the web application firewall, since Serv-U does not require that functionality, or otherwise restrict access to known source addresses. The affected range is Serv-U 15.5.4 and below, fixed in Serv-U 15.5.4 Hotfix 1 (SolarWinds Trust Center Advisory CVE-2026-28318).
CISA added CVE-2026-28318 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-06-05, with a required-action due date of 2026-06-19, and records knownRansomwareCampaignUse as "Unknown" (CISA KEV).
As of 2026-10-29, FIRST scores the probability of exploitation at 0.4365 (98.738th percentile) — unusually high for a denial-of-service bug, consistent with its KEV listing and the fact that internet-facing Serv-U file-transfer servers are routinely scanned (FIRST EPSS).
Because the crash requires no authentication and Serv-U is typically exposed to transfer files with external parties, any instance at or below 15.5.4 should be patched to 15.5.4 Hotfix 1 or protected at the WAF by blocking POST requests carrying a Content-Encoding header until the update can be applied.
Evidence
- Unauthenticated, specially crafted HTTP POST requests using Content-Encoding: deflate crash the SolarWinds Serv-U service (CWE-400, Uncontrolled Resource Consumption). — NVD
- CVSS v3.1 base score is 7.5 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, submitted by SolarWinds' own CNA and stored by NVD as a Secondary (not NVD-confirmed) metric. — NVD
- Affected: Serv-U 15.5.4 and below; fixed in Serv-U 15.5.4 Hotfix 1. Interim mitigation: block POST requests containing a Content-Encoding header at the WAF. — SolarWinds Trust Center Advisory CVE-2026-28318
- Added to the CISA Known Exploited Vulnerabilities catalog on 2026-06-05, required action due 2026-06-19; knownRansomwareCampaignUse recorded as "Unknown". — CISA KEV
- EPSS score is 0.4365 (98.738th percentile) as of 2026-10-29. — FIRST EPSS