CVE-2026-28318: SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability
SolarWinds Serv-U contains an uncontrolled resource consumption vulnerability that allows specially crafted POST requests using the Content-Encoding: deflate header to crash the Serv-U service without authentication.
Other sources
SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate. Mitigation steps are provided to secure customer environments in the SolarWinds Trust Center if you are unable to deploy the update
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SolarWinds Serv-Uto a version that resolves this vulnerability.Fixed in 15.5.4 Hotfix 1 - Compensating control
If the upgrade to SolarWinds Serv-U 15.5.4 Hotfix 1 is not yet possible, use the mitigation steps provided in the SolarWinds Trust Center for these vulnerabilities to secure customer environments.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-28318?
CVE-2026-28318 has a severity rating of high with a score of 7.5.
How do I fix CVE-2026-28318?
To address CVE-2026-28318, upgrade to SolarWinds Serv-U 15.5.4 Hotfix 1 and implement the recommended mitigation steps.
What type of vulnerability is CVE-2026-28318?
CVE-2026-28318 is an uncontrolled resource consumption vulnerability that results in an unauthenticated denial of service.
Is CVE-2026-28318 actively being exploited?
Yes, CVE-2026-28318 is KEV-listed and has been identified as actively exploited.
What impact does CVE-2026-28318 have on SolarWinds Serv-U?
CVE-2026-28318 allows specially crafted POST requests to crash the SolarWinds Serv-U service without requiring authentication.