Action Required for SolarWinds Serv-U Users

CISA has officially added CVE-2026-28318 to its Known Exploited Vulnerabilities (KEV) Catalog, confirming that this high-severity flaw is being actively exploited in the wild.

What You Need to Know

1- The Vulnerability: An uncontrolled resource consumption issue in SolarWinds Serv-U file server software.

2- The Impact: Remote, unauthenticated attackers can send a specially crafted HTTP POST request (using Content-Encoding: deflate) to crash the service, resulting in a Denial-of-Service (DoS) condition.

3- Severity: Rated as High, this flaw allows for service disruption without requiring any user credentials.

Recommended Actions

4- Immediate Patching: Update your SolarWinds Serv-U installation to version 15.5.4 Hotfix 1 immediately. Even if you have already upgraded to 15.5.4, you must apply this specific hotfix.

Mitigation (If Patching is Delayed):

Limit access to your Serv-U instances to known, trusted IP addresses using a Web Application Firewall (WAF) or similar security controls.

Configure your firewall/security appliances to block any requests containing the Content-Encoding header, as this functionality is not required for standard Serv-U operations.

Compliance: U.S. Federal Civilian Executive Branch (FCEB) agencies are required to remediate this vulnerability by June 19, 2026, per CISA’s Binding Operational Directive 22-01.

While this vulnerability is currently identified as a DoS risk, ensuring your file transfer infrastructure is secure is critical to maintaining operational continuity. Please review your environment today to ensure these updates are applied.

#CyberSecurity #SolarWinds #InfoSec #CISA #VulnerabilityManagement #TechNews