CVE-2026-28318

HIGH CISA KEV EPSS 95.2%
Published Jun 4, 20263w ago · Modified Jun 17, 20261w ago
7.5 CVSS 3.1
High
Find Similar
Published Jun 4, 2026 3w ago
Last Modified Jun 17, 2026 1w ago
KEV Listed Jun 5, 2026 3w ago
KEV Due Jun 19, 2026 11d overdue

Description

SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate. Mitigation steps are provided to secure customer environments in the SolarWinds Trust Center if you are unable to deploy the update

CVSS Details

Base Score
7.5
Exploitability
3.9
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

CISA Known Exploited Overdue 11d
Added
Jun 5, 2026
Due
Jun 19, 2026

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

EPSS Exploit Probability
95.2% percentile
Exploit & Patch Status
Actively Exploited (KEV)
No Patch Available

Weaknesses 1

CWE-400 Uncontrolled Resource Consumption Resource Mgmt

Affected Products 2

VendorProductVersionRange
solarwindsserv-u* <15.5.4
solarwindsserv-u15.5.4any

References 3

  • documentation.solarwinds.com https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-5-4-hotfix-1_release_notes.htm
    Release Notes
  • cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-28318
    US Government Resource
  • solarwinds.com https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28318
    Vendor Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.