{"id":"CVE-2026-28318","kind":"vulnerability","aliases":["CVE-2026-28318"],"related":[],"title":"SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without…","description":"SolarWinds Serv-U contains an uncontrolled resource consumption vulnerability that allows specially crafted POST requests using the Content-Encoding: deflate header to crash the Serv-U service without authentication.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"SolarWinds Serv-U has an uncontrolled resource consumption bug: specially crafted unauthenticated POST requests with a Content-Encoding: deflate header crash the Serv-U service. An attacker needs no login to take the file transfer service down, and CISA lists it as actively exploited.","severity":"high","cvss":7.5,"epss":null,"exploited":true,"exploited_at":"2026-06-05T00:00:00+00:00","products":[{"name":"solarwinds serv-u","fixed":["15.5.4"],"affected":"< 15.5.4","ecosystem":"vendor"},{"name":"solarwinds serv-u","fixed":[],"affected":"= 15.5.4","ecosystem":"vendor"},{"name":"SolarWinds Serv-U","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","file-transfer","package","self-hosted","serv-u","solarwinds"],"not_affected_if":["no-serv-u-deployment"],"how_to_check":"Check whether you run SolarWinds Serv-U and which build it is, using the Serv-U admin console or the installed version.","fix":"Apply the vendor mitigations per SolarWinds instructions, or discontinue use of Serv-U if mitigations are unavailable (CISA required action).","status":"open","published_at":"2026-06-04T15:16:50+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:33:58+00:00","updated_at":"2026-10-24T00:09:50+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T20:33:58Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigations per SolarWinds instructions, or discontinue use of Serv-U if mitigations are unavailable (CISA required action).\nunknown","summary":"SolarWinds Serv-U has an uncontrolled resource consumption bug: specially crafted unauthenticated POST requests with a Content-Encoding: deflate header crash the Serv-U service. An attacker needs no login to take the file transfer service down, and CISA lists it as actively exploited.","category":"package","who_cares":["solarwinds","serv-u","file-transfer","self-hosted"],"confidence":0.6,"analyst_note":"Sources list no affected or fixed versions and no vendor advisory URL; find the SolarWinds advisory and patch build for CVE-2026-28318 and the exact mitigation steps.","how_to_check":"Check whether you run SolarWinds Serv-U and which build it is, using the Serv-U admin console or the installed version.\nunknown\nunknown","needs_analyst":true,"not_affected_if":["no-serv-u-deployment"],"severity_if_unknown":"high"},"cost_usd":0.000401,"input_tokens":2095,"output_tokens":382,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':141C '-2026':21A,24A '-28318':22A,25A '22':140C 'action':131C 'activ':95B 'allow':108C 'appli':132C 'applic':138C 'attack':79B 'authent':128C 'bod':139C 'bug':59B 'cisa':91B,129C 'cloud':144C 'consumpt':58B,105C 'contain':101C 'content':68B,116C 'content-encod':67B,115C 'craft':9A,61B,110C 'crash':13A,72B,121C 'cve':20A,23A 'deflat':70B,118C 'discontinu':147C 'encod':69B,117C 'exploit':38B,96B 'file':40B,86B 'file-transf':39B 'follow':137C 'guidanc':142C 'header':71B,119C 'host':45B 'instruct':136C 'list':92B 'login':82B 'mitig':133C,153C 'need':80B 'packag':42B 'per':134C 'post':10A,63B,111C 'product':151C 'request':11A,64B,112C 'requir':130C 'resourc':57B,104C 'self':44B 'self-host':43B 'serv':3A,16A,28A,32A,36A,47B,52B,75B,99C,124C 'serv-u':2A,15A,27A,31A,35A,46B,51B,74B,98C,123C 'servic':18A,77B,88B,126C,145C 'solarwind':1A,49B,50B,97C 'solarwinds':26A,30A,34A 'special':8A,60B,109C 'suscept':6A 'take':84B 'transfer':41B,87B 'u':4A,17A,29A,33A,37A,48B,53B,76B,100C,125C 'unauthent':62B 'unavail':155C 'uncontrol':56B,103C 'use':113C,148C 'vendor':135C 'vulner':106C 'without':19A,127C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-06-04T15:16:50+00:00","kev":{"dateAdded":"2026-06-05","dueDate":"2026-06-19","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"psirt@solarwinds.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-28318","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-28318","severity":null,"published_at":"2026-06-05T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T12:39:21+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-28318","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28318","severity":null,"published_at":"2026-06-04T15:16:50+00:00","modified_at":"2026-10-21T11:17:07+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}