Active Exploit of SolarWinds Serv‑U DoS Vulnerability (CVE‑2026‑28318) Threatens File Transfer Services

Active Exploit of SolarWinds Serv‑U DoS Vulnerability (CVE‑2026‑28318) Threatens File Transfer Services

What It Is – A remote, unauthenticated denial‑of‑service (DoS) flaw in SolarWinds Serv‑U (CVE‑2026‑28318) allows attackers to crash the file‑transfer service by sending specially crafted HTTP POST requests with a Content‑Encoding: deflate header.

Exploitability – CISA has confirmed the vulnerability is being leveraged in the wild. A patch (Serv‑U 15.5.4 Hotfix 1) is available; no public CVSS score yet, but the active exploitation and potential for service disruption merit a High severity rating.

Affected Products – SolarWinds Serv‑U 15.5.4 and earlier versions (self‑hosted file‑transfer servers).

TPRM Impact – Organizations that rely on Serv‑U for regulated data exchange (healthcare, finance, government) face operational downtime, audit‑trail interruptions, and possible distraction of security teams from other threats.

Recommended Actions –

1. Deploy Serv‑U 15.5.4 Hotfix 1 immediately (or upgrade to the latest release).
2. If patching cannot be completed by June 19 2026, enforce mitigations: restrict inbound traffic to known IP ranges via firewall/WAF and block HTTP POST requests containing the Content‑Encoding header.
3. Verify that logging and monitoring capture failed POST attempts to detect ongoing exploitation attempts.
4. Review third‑party risk registers to confirm Serv‑U usage across your supply chain and update contractual security clauses accordingly.

Source: Help Net Security – CISA: Patch actively exploited SolarWinds Serv‑U DoS vulnerability (CVE‑2026‑28318)