Loading story…
SolarWinds Serv-U is affected by CVE-2026-28318, a high-severity unauthenticated denial-of-service flaw in the product’s web interface that has been added to CISA’s Known Exploited Vulnerabilities catalog after active exploitation was confirmed in the wild. The bug can be triggered with a single crafted POST request that includes the Content-Encoding: deflate header and any non-empty body, leading to heap corruption and a crash of the Serv-U process.
Research cited in public reporting found the issue stems from a logic error that bypasses Serv-U’s deflate rejection check when HTTP compression is enabled by default, making the vulnerability a practical crash vector rather than a realistic route to remote code execution. SolarWinds addressed the flaw in Serv-U 15.5.4 HF1 by rejecting requests with a non-empty Content-Encoding header before request-body processing, and defenders were advised they can safely identify patched systems by checking whether a POST request using Content-Encoding: identity returns HTTP 415.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
SolarWinds addressed CVE-2026-28318 in Serv-U 15.5.4 HF1 by rejecting requests with a non-empty Content-Encoding header before processing the request body.
On June 7, 2026, SolarWinds released a security update to fix CVE-2026-28318, an unauthenticated denial-of-service flaw affecting Serv-U 15.5.4 and earlier versions. The update addresses crashes triggered by specially crafted POST requests using the "Content-Encoding: deflate" header.
CISA added CVE-2026-28318, a high-severity unauthenticated denial-of-service flaw in SolarWinds Serv-U, to its Known Exploited Vulnerabilities catalog with active exploitation in the wild confirmed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
codeby.net
Open sourceegfincirt-wpn.azurewebsites.net
Open sourceegfincirt.org.eg
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SolarWinds **Serv-U** versions `15.5.4.108` and earlier are affected by **CVE-2026-28318**, an unauthenticated denial-of-service flaw that can crash the service through the default-enabled web interface. Bishop Fox reported that a single `POST` request carrying a `Content-Encoding: deflate` header and any body can trigger heap corruption caused by an invalid `free()` in the product’s in-memory decompressor, aborting the Serv-U process. Although the bug initially raised concern about possible memory-corruption exploitation, testing found the practical impact to be service availability loss rather than remote code execution. SolarWinds addressed the issue in **Serv-U 15.5.4 HF1** by rejecting requests that include a body and a non-empty `Content-Encoding` header with HTTP `415` before the body is processed; patched builds are identified as `15.5.4.125` or later. Bishop Fox also published a production-safe detection tool on GitHub that avoids sending the crashing input and instead checks for the `415` response using a benign request, while warning that reverse proxies or load balancers may affect results. Organizations are advised to upgrade to **15.5.4 HF1 or later**, block `POST` requests with `Content-Encoding` headers at a WAF or reverse proxy, and limit Serv-U web interface exposure to trusted networks until patching is complete.
Jun 29, 2026
CISA warned that attackers are actively exploiting **SolarWinds Serv-U** vulnerability `CVE-2026-28318`, a recently patched high-severity denial-of-service flaw in the company's managed file transfer and FTP server software for **Windows and Linux**. The bug can be triggered through low-complexity, unauthenticated `POST` requests—reported to include the `Content-Encoding: deflate` header—causing the Serv-U service to crash through uncontrolled resource consumption. CISA has added the issue to its **Known Exploited Vulnerabilities** catalog and directed Federal Civilian Executive Branch agencies to remediate by **June 19** under Binding Operational Directive 22-01. SolarWinds said the flaw is fixed in **Serv-U 15.5.4 Hotfix 1**, while CISA urged private-sector organizations to apply mitigations immediately or discontinue use if mitigations are unavailable. Reporting also noted that thousands of Serv-U servers remain exposed online, expanding the potential attack surface. The warning comes amid a broader pattern of SolarWinds Serv-U exploitation, with earlier campaigns tied to the **Clop** ransomware gang, **DEV-0322** Chinese threat actors, and abuse of prior Serv-U vulnerabilities.
Jun 29, 2026
SolarWinds disclosed and patched multiple high-severity vulnerabilities in **Serv-U** that can let authenticated attackers take over accounts, escalate privileges, read and write arbitrary files, and in some cases achieve remote code execution as `root`. The issues affect **Serv-U 15.5.4 HF1 and earlier** on both Windows and Linux, with SolarWinds noting the impact is generally more severe on Linux and lower on Windows. The vendor fixed the flaws in **Serv-U 2026.3** and said the vulnerabilities were reported through the **Intigriti** bug bounty program. The disclosed CVEs include broken access control, privilege escalation, and **IDOR** weaknesses such as **`CVE-2026-28321`** for arbitrary file read/write that can be leveraged into code execution, **`CVE-2026-28312`** and **`CVE-2026-28310`** for elevation to system administrator, **`CVE-2026-28309`** for creating system administrator accounts, and **`CVE-2026-28313`**, **`CVE-2026-28314`**, **`CVE-2026-28316`**, and **`CVE-2026-28317`** for account takeover, SMTP hijacking, and further privilege escalation. SolarWinds said the bugs require existing privileges rather than unauthenticated access, but warned that stolen or low-tier credentials could be chained to gain full control of a Serv-U host; no public exploits or confirmed in-the-wild abuse had been reported at disclosure.
Jul 22, 2026