CISA Warns Active Exploitation of SolarWinds Serv-U DoS Flaw
Active Exploitation · 10 sources · Updated 4mo ago · First seen Jun 5, 2026
CISA warned that attackers are actively exploiting SolarWinds Serv-U vulnerability CVE-2026-28318, a recently patched high-severity denial-of-service flaw in the company's managed file transfer and FTP server software for Windows and Linux. The bug can be triggered through low-complexity, unauthenticated POST requests—reported to include the Content-Encoding: deflate header—causing the Serv-U service to crash through uncontrolled resource consumption. CISA has added the issue to its Known Exploited Vulnerabilities catalog and directed Federal Civilian Executive Branch agencies to remediate by June 19 under Binding Operational Directive 22-01.
SolarWinds said the flaw is fixed in Serv-U 15.5.4 Hotfix 1, while CISA urged private-sector organizations to apply mitigations immediately or discontinue use if mitigations are unavailable. Reporting also noted that thousands of Serv-U servers remain exposed online, expanding the potential attack surface. The warning comes amid a broader pattern of SolarWinds Serv-U exploitation, with earlier campaigns tied to the Clop ransomware gang, DEV-0322 Chinese threat actors, and abuse of prior Serv-U vulnerabilities.
