Serv-U crash via unauth POST (CVE-2026-28318)
CVE-2026-28318
CVE-2026-28318: SolarWinds Serv-U unauthenticated POST request causes denial of service via Content-Encoding: deflate (CVSS 7.5, actively exploited). Update or apply mitigations from Trust Center.
Actively exploited in the wild - CVE-2026-28318 is a high-severity denial-of-service vulnerability in SolarWinds Serv-U that lets unauthenticated attackers crash the service using specially crafted POST requests with Content-Encoding: deflate. Patches are available; apply updates or mitigate via the Trust Center if patching is delayed.
Overview
CVE-2026-28318 affects SolarWinds Serv-U, a managed file transfer application. The vulnerability resides in how Serv-U processes HTTP POST requests with the Content-Encoding: deflate header. By sending a crafted request, an unauthenticated attacker can trigger a crash of the Serv-U service, causing a denial-of-service condition. The attack requires no authentication, no user interaction, and can be performed over the network with low complexity.
Impact
A successful exploit results in the Serv-U service process crashing, denying legitimate users access to file transfer operations. While this is a denial-of-service (availability impact) rather than a data breach vector, the unauthenticated nature and active exploitation in the wild make it a critical priority for affected organizations. CISA has added this CVE to its Known Exploited Vulnerabilities (KEV) catalog.
Affected Versions
SolarWinds Serv-U versions prior to the patched release are affected. Check the SolarWinds Trust Center for the exact version range.
Remediation
SolarWinds has released a security update addressing CVE-2026-28318. Deploy the latest version of Serv-U from the SolarWinds Trust Center immediately. If you cannot apply the update, implement mitigations as detailed in the SolarWinds security advisory, such as restricting network access to the Serv-U management interface and applying web application firewall rules to block suspicious Content-Encoding: deflate requests.
Security Insight
This vulnerability underscores a recurring pattern in enterprise file-transfer and managed-services software: encoding-handler flaws that require no authentication to exploit. The active exploitation of this crash bug suggests it may be used as a precursor to more damaging attacks, such as service takeover or ransomware deployment. SolarWinds customers should treat this as a proof point that even availability-impact vulnerabilities deserve immediate patching when they appear on the CISA KEV list.
Further Reading
Never miss a critical vulnerability
Get real-time security alerts delivered to your preferred platform.
Related Advisories
A broken access control vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to create a system admin user and execute arbitrary code as a privileged account via do...
A type confusion vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to execute arbitrary native code as privileged account. This issue requires administrative pr...
A type confusion vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to execute arbitrary native code as privileged account. This issue requires administrative pr...
An Insecure Direct Object Reference (IDOR) vulnerability exists in Serv-U, which when exploited, gives a malicious actor the ability to execute native code as a privileged account. This issue require...
Other Solarwinds Serv-U Vulnerabilities
A broken access control vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to create a system admin user and execute arbitrary code as a privileged account via do...
A type confusion vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to execute arbitrary native code as privileged account. This issue requires administrative pr...
A type confusion vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to execute arbitrary native code as privileged account. This issue requires administrative pr...
An Insecure Direct Object Reference (IDOR) vulnerability exists in Serv-U, which when exploited, gives a malicious actor the ability to execute native code as a privileged account. This issue require...