Loading story…
CISA warned that attackers are actively exploiting SolarWinds Serv-U vulnerability CVE-2026-28318, a recently patched high-severity denial-of-service flaw in the company's managed file transfer and FTP server software for Windows and Linux. The bug can be triggered through low-complexity, unauthenticated POST requests—reported to include the Content-Encoding: deflate header—causing the Serv-U service to crash through uncontrolled resource consumption. CISA has added the issue to its Known Exploited Vulnerabilities catalog and directed Federal Civilian Executive Branch agencies to remediate by June 19 under Binding Operational Directive 22-01.
SolarWinds said the flaw is fixed in Serv-U 15.5.4 Hotfix 1, while CISA urged private-sector organizations to apply mitigations immediately or discontinue use if mitigations are unavailable. Reporting also noted that thousands of Serv-U servers remain exposed online, expanding the potential attack surface. The warning comes amid a broader pattern of SolarWinds Serv-U exploitation, with earlier campaigns tied to the Clop ransomware gang, DEV-0322 Chinese threat actors, and abuse of prior Serv-U vulnerabilities.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
CISA added CVE-2026-28318 to its Known Exploited Vulnerabilities Catalog and ordered Federal Civilian Executive Branch agencies to remediate the flaw under Binding Operational Directive 22-01. The deadline given to federal agencies was June 19, and CISA also urged private-sector organizations to apply mitigations quickly.
CISA warned that attackers are actively exploiting CVE-2026-28318 in SolarWinds Serv-U to crash vulnerable servers. The agency said the denial-of-service issue can be exploited with low-complexity, unauthenticated POST requests.
SolarWinds released Serv-U 15.5.4 Hotfix 1 to fix CVE-2026-28318, a high-severity denial-of-service flaw caused by uncontrolled resource consumption. The bug affects Serv-U managed file transfer and FTP server software on Windows and Linux and can be triggered with crafted unauthenticated POST requests.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
10 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourceccb.belgium.be
Open sourcethecyberthrone.in
Open sourcearetiq.ai
Open sourcesecurityonline.info
Open sourcescworld.com
Open sourcebleepingcomputer.com
Open sourcedocumentation.solarwinds.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SolarWinds Serv-U is affected by **`CVE-2026-28318`**, a high-severity unauthenticated denial-of-service flaw in the product’s web interface that has been added to CISA’s Known Exploited Vulnerabilities catalog after active exploitation was confirmed in the wild. The bug can be triggered with a single crafted `POST` request that includes the `Content-Encoding: deflate` header and any non-empty body, leading to heap corruption and a crash of the Serv-U process. Research cited in public reporting found the issue stems from a logic error that bypasses Serv-U’s deflate rejection check when HTTP compression is enabled by default, making the vulnerability a practical crash vector rather than a realistic route to remote code execution. SolarWinds addressed the flaw in **Serv-U 15.5.4 HF1** by rejecting requests with a non-empty `Content-Encoding` header before request-body processing, and defenders were advised they can safely identify patched systems by checking whether a `POST` request using `Content-Encoding: identity` returns HTTP `415`.
Jul 8, 2026
SolarWinds disclosed **CVE-2024-28995**, a high-severity directory traversal and local file disclosure flaw in its **Serv-U** managed file transfer software that affects versions earlier than **15.4.2 Hotfix 2**. The vulnerability can be exploited remotely and without authentication via crafted HTTP `GET` requests, allowing attackers to read arbitrary files from the host system, including sensitive material such as credentials, certificates, and configuration data. Rapid7 described the issue as trivially exploitable, and SolarWinds issued fixes through **Serv-U 15.4.2 HF2**, with deployment requiring **15.4.2 HF1** first. Security researchers and national defenders reported that exploitation began quickly after disclosure. GreyNoise observed internet-wide exploitation activity targeting exposed Serv-U instances, while CSIRT.SK warned that public scanning tools and proof-of-concept exploit code were increasing the likelihood of opportunistic attacks. The combination of unauthenticated access, straightforward exploitation, and the ability to extract sensitive files has made patching exposed Serv-U servers an urgent priority.
Jul 23, 2026
SolarWinds disclosed and patched multiple high-severity vulnerabilities in **Serv-U** that can let authenticated attackers take over accounts, escalate privileges, read and write arbitrary files, and in some cases achieve remote code execution as `root`. The issues affect **Serv-U 15.5.4 HF1 and earlier** on both Windows and Linux, with SolarWinds noting the impact is generally more severe on Linux and lower on Windows. The vendor fixed the flaws in **Serv-U 2026.3** and said the vulnerabilities were reported through the **Intigriti** bug bounty program. The disclosed CVEs include broken access control, privilege escalation, and **IDOR** weaknesses such as **`CVE-2026-28321`** for arbitrary file read/write that can be leveraged into code execution, **`CVE-2026-28312`** and **`CVE-2026-28310`** for elevation to system administrator, **`CVE-2026-28309`** for creating system administrator accounts, and **`CVE-2026-28313`**, **`CVE-2026-28314`**, **`CVE-2026-28316`**, and **`CVE-2026-28317`** for account takeover, SMTP hijacking, and further privilege escalation. SolarWinds said the bugs require existing privileges rather than unauthenticated access, but warned that stolen or low-tier credentials could be chained to gain full control of a Serv-U host; no public exploits or confirmed in-the-wild abuse had been reported at disclosure.
Jul 22, 2026