Loading story…
SolarWinds Serv-U versions 15.5.4.108 and earlier are affected by CVE-2026-28318, an unauthenticated denial-of-service flaw that can crash the service through the default-enabled web interface. Bishop Fox reported that a single POST request carrying a Content-Encoding: deflate header and any body can trigger heap corruption caused by an invalid free() in the product’s in-memory decompressor, aborting the Serv-U process. Although the bug initially raised concern about possible memory-corruption exploitation, testing found the practical impact to be service availability loss rather than remote code execution.
SolarWinds addressed the issue in Serv-U 15.5.4 HF1 by rejecting requests that include a body and a non-empty Content-Encoding header with HTTP 415 before the body is processed; patched builds are identified as 15.5.4.125 or later. Bishop Fox also published a production-safe detection tool on GitHub that avoids sending the crashing input and instead checks for the 415 response using a benign request, while warning that reverse proxies or load balancers may affect results. Organizations are advised to upgrade to 15.5.4 HF1 or later, block POST requests with Content-Encoding headers at a WAF or reverse proxy, and limit Serv-U web interface exposure to trusted networks until patching is complete.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
On 2026-06-16, Bishop Fox published analysis concluding that CVE-2026-28318 in SolarWinds Serv-U is caused by heap corruption from an invalid free() in an in-memory decompressor, but that the practical impact is denial of service rather than remote code execution. The write-up states the issue can crash the service with a single unauthenticated POST request carrying a Content-Encoding: deflate header and a body.
SolarWinds addressed CVE-2026-28318 in Serv-U 15.5.4 Hotfix 1 by rejecting requests that contain a body and a non-empty Content-Encoding header with HTTP 415 before the body is processed. The references indicate patched systems are build 15.5.4.125 or later.
On 2026-06-12, Bishop Fox published a non-destructive GitHub tool to identify whether a SolarWinds Serv-U host is vulnerable to CVE-2026-28318 without triggering the crash. The script sends a benign POST request with Content-Encoding: identity and treats HTTP 415 as evidence that the HF1 fix is present.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
bishopfox.com
Open sourcebishopfox.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SolarWinds Serv-U is affected by **`CVE-2026-28318`**, a high-severity unauthenticated denial-of-service flaw in the product’s web interface that has been added to CISA’s Known Exploited Vulnerabilities catalog after active exploitation was confirmed in the wild. The bug can be triggered with a single crafted `POST` request that includes the `Content-Encoding: deflate` header and any non-empty body, leading to heap corruption and a crash of the Serv-U process. Research cited in public reporting found the issue stems from a logic error that bypasses Serv-U’s deflate rejection check when HTTP compression is enabled by default, making the vulnerability a practical crash vector rather than a realistic route to remote code execution. SolarWinds addressed the flaw in **Serv-U 15.5.4 HF1** by rejecting requests with a non-empty `Content-Encoding` header before request-body processing, and defenders were advised they can safely identify patched systems by checking whether a `POST` request using `Content-Encoding: identity` returns HTTP `415`.
Jul 8, 2026
CISA warned that attackers are actively exploiting **SolarWinds Serv-U** vulnerability `CVE-2026-28318`, a recently patched high-severity denial-of-service flaw in the company's managed file transfer and FTP server software for **Windows and Linux**. The bug can be triggered through low-complexity, unauthenticated `POST` requests—reported to include the `Content-Encoding: deflate` header—causing the Serv-U service to crash through uncontrolled resource consumption. CISA has added the issue to its **Known Exploited Vulnerabilities** catalog and directed Federal Civilian Executive Branch agencies to remediate by **June 19** under Binding Operational Directive 22-01. SolarWinds said the flaw is fixed in **Serv-U 15.5.4 Hotfix 1**, while CISA urged private-sector organizations to apply mitigations immediately or discontinue use if mitigations are unavailable. Reporting also noted that thousands of Serv-U servers remain exposed online, expanding the potential attack surface. The warning comes amid a broader pattern of SolarWinds Serv-U exploitation, with earlier campaigns tied to the **Clop** ransomware gang, **DEV-0322** Chinese threat actors, and abuse of prior Serv-U vulnerabilities.
Jun 29, 2026
SolarWinds disclosed **CVE-2024-28995**, a high-severity directory traversal and local file disclosure flaw in its **Serv-U** managed file transfer software that affects versions earlier than **15.4.2 Hotfix 2**. The vulnerability can be exploited remotely and without authentication via crafted HTTP `GET` requests, allowing attackers to read arbitrary files from the host system, including sensitive material such as credentials, certificates, and configuration data. Rapid7 described the issue as trivially exploitable, and SolarWinds issued fixes through **Serv-U 15.4.2 HF2**, with deployment requiring **15.4.2 HF1** first. Security researchers and national defenders reported that exploitation began quickly after disclosure. GreyNoise observed internet-wide exploitation activity targeting exposed Serv-U instances, while CSIRT.SK warned that public scanning tools and proof-of-concept exploit code were increasing the likelihood of opportunistic attacks. The combination of unauthenticated access, straightforward exploitation, and the ability to extract sensitive files has made patching exposed Serv-U servers an urgent priority.
Jul 23, 2026