CVE-2026-28318
SolarWinds Serv-U DoS via Malformed POST Request
Publication date: 2026-06-04
Last updated on: 2026-06-04
Assigner: SolarWinds
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| solarwinds | serv-u | to 15.5.4 (exc) |
| solarwinds | serv-u | 15.5.4 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-400 | The product does not properly control the allocation and maintenance of a limited resource. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves specially crafted POST requests with the header Content-Encoding: deflate that cause the Serv-U service to crash without authentication.
To detect this vulnerability on your network or system, you can monitor for unusual crashes or service interruptions of the Serv-U service, especially following POST requests containing the Content-Encoding: deflate header.
You may also capture and analyze network traffic to identify POST requests with the Content-Encoding: deflate header targeting the Serv-U service.
- Use network packet capture tools like tcpdump or Wireshark to filter HTTP POST requests with Content-Encoding: deflate. For example, with tcpdump:
- tcpdump -i <interface> -A 'tcp port 80 or tcp port 443' | grep -i 'Content-Encoding: deflate'
- Check Serv-U service logs for crashes or restarts that correlate with such requests.
Note that no specific detection commands are provided in the available resources, but monitoring for these indicators can help identify exploitation attempts.
Can you explain this vulnerability to me?
CVE-2026-28318 is a high-severity vulnerability in SolarWinds Serv-U that allows an attacker to crash the Serv-U service by sending specially crafted POST requests using the Content-Encoding: deflate header.
This attack can be performed without any authentication, meaning anyone who can send requests to the service can exploit this flaw.
The vulnerability causes a denial of service by crashing the service, disrupting its normal operation.
How can this vulnerability impact me? :
This vulnerability can impact you by causing a denial of service on the SolarWinds Serv-U service.
An attacker can crash the service without authentication, leading to service downtime and potential disruption of business operations that rely on Serv-U.
Until the vulnerability is patched, affected environments remain at risk of being taken offline by such attacks.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the CVE-2026-28318 vulnerability in SolarWinds Serv-U, you should apply the hotfix provided in Serv-U version 15.5.4 Hotfix 1, which patches the affected components and prevents unauthenticated denial of service attacks.
- Stop the Serv-U processes before applying the hotfix.
- Back up key files to ensure you can restore the system if needed.
- Extract and apply the hotfix as per the instructions.
- Restart the Serv-U service after applying the hotfix.
If you are unable to deploy the update immediately, follow the mitigation steps provided in the SolarWinds Trust Center to secure your environment until the patch can be applied.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of CVE-2026-28318 on compliance with common standards and regulations such as GDPR or HIPAA.