SolarWinds Web Help Desk is found to be affected by a SAML authentication bypass vulnerability. This requires the SAML 2.0 authentication method to be enabled.

SolarWinds Serv-U is affected by a broken access control vulnerability that could allow arbitrary file read and write, which can then be used to escalate privileges and execute code as root. A domain administrator access is required, and the impact is lower in Windows installations.

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation. This issue requires domain administrator access. The impact is lower in Windows deployments.

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation to a system administrator with the ability to execute commands as the root user. This issue requires a domain account with administrator access. The impact is lower in Windows deployments.

SolarWinds Serv-U was found to be affected by a stored cross-site scripting vulnerability that could lead to session hijacking or information disclosure from an administrator account.

SolarWinds Serv-U is affected by an insecure direct object reference vulnerability that leads to an account takeover. User authentication is required. The impact is lower in Windows deployments.

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to SMTP hijacking leading to arbitrary account takeover. The impact is lower in Windows deployments.

SolarWinds Serv-U is affected by a privilege escalation vulnerability. This would elevate a group’s access to system administrator and allow code execution as root. The impact is lower in Windows deployments.

SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to escalate their user type to that of a system administrator. The impact is lower in Windows deployments.

SolarWinds Serv-U is affected by a broken access control vulnerability that allows a domain administrator to create system administrator accounts. The impact is lower in Windows deployments.

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution. Domain administrator access is required. The impact is lower in Windows deployments.

SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain user group to be elevated into an administrator group. The impact is lower in Windows deployments.

SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to elevate their privileges to a system administrator. The impact is lower in Windows deployments.

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution as root. A domain account with admin privileges and read and write access to the home directory is required. The impact is lower in Windows deployments.

SolarWinds Serv-U is affected by a remote code execution vulnerability that, when exploited, can allow the arbitrary execution of code remotely as root. The impact is lower in Windows deployments.

SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation and remote code execution as root. This issue requires group administrator access. The impact is lower in Windows deployments.

SolarWinds Database Performance Analyzer was found to be affected by a stored cross-site scripting vulnerability, which when exploited, can lead to unintended script execution.

A vulnerability in which an attacker can provide a crafted external URL that may redirect a user to an unintended website.

Hello all! Since the post last week seemed to be helpful to some folks, I figured I'd make another post this week.

The big, bad, scary one is the Netlogon RCE because it targets domain controllers and is now confirmed exploited. After that, I’d be looking at Palo Alto GlobalProtect, SolarWinds Serv-U, Cisco SD-WAN Manager, and any Linux container hosts that might still be exposed to the old cgroups v1 escape.

Here's the order I’d work them:

1. CVE-2026-41089: Microsoft Windows Netlogon

Stack-based buffer overflow in Netlogon. An unauthenticated attacker can hit a domain controller over the network and get code execution.

Affected: Windows Server 2012 R2 through 2025.

Why it matters: CVSS 9.8. Active exploitation has been confirmed by Belgium’s CCB.

Action: If your DCs got May’s cumulative update, you should be covered. If you deferred May updates on domain controllers, I’d move this to the top of the queue. Find your rollup patches here for your Server version.

2. CVE-2026-0257: Palo Alto Networks PAN-OS GlobalProtect

Authentication bypass in the GlobalProtect portal and gateway. The short version is that forged cookies can give an attacker an unauthorized VPN session.

Affected: PAN-OS firewalls with a GlobalProtect portal or gateway where authentication override cookies are enabled.

Why it matters: CVSS 9.1. Exploited in the wild and on CISA KEV.

Action: Patch to a fixed PAN-OS release. If you can’t patch immediately, disable authentication override or use a dedicated certificate only for that feature.

3. CVE-2026-28318: SolarWinds Serv-U

Unauthenticated denial of service. A crafted POST request with a Content-Encoding: deflate header can crash the Serv-U service.

Affected: Serv-U file transfer versions before 15.5.4, and 15.5.4 without Hotfix 1.

Why it matters: CVSS 7.5. Exploited in the wild. Added to CISA KEV on June 5 with a federal deadline of June 19.

Action: Update to Serv-U 15.5.4 Hotfix 1. If you need an interim move, restrict access to known IPs and block POST requests carrying a Content-Encoding header.

4. CVE-2026-20245: Cisco Catalyst SD-WAN Manager

Command injection in Cisco Catalyst SD-WAN Manager. A crafted file upload can run arbitrary commands as root.

Affected: Cisco Catalyst SD-WAN Manager, formerly vManage.

Why it matters: CVSS 7.8. Exploited as a zero-day. No patch available yet.

Action: This one does require netadmin privileges, so it is not the same kind of emergency as an unauthenticated internet-facing RCE. But with no fix available, I’d still lock down who can reach SD-WAN Manager, audit netadmin accounts, make sure MFA is solid, and watch Cisco’s advisory for the patch. You can see Cisco's additional recommendations here.

5. CVE-2022-0492: Linux kernel cgroups v1 container escape

Old bug, but newly relevant again because CISA added it to KEV last week. The cgroups v1 releaseagent issue can let a low-privileged local user escape a container and escalate to root.

Affected: Linux hosts running containers on unpatched kernels or with overly permissive container configs.

Why it matters: CVSS 7.8. Added to CISA KEV on June 2 based on evidence of active exploitation.

Action: Check your container hosts. Make sure kernels are patched, containers are not running with CAPSYSADMIN, and AppArmor/SELinux/Seccomp profiles are actually enforced.

Three of these are on CISA KEV: Palo Alto, Serv-U, and the Linux cgroups bug.

If I only had time to clear one, I’d start with Netlogon. Unauthenticated RCE against domain controllers is not something I’d want sitting around, especially now that exploitation has been confirmed.

Serv-U would be next if it is internet-facing, then Palo Alto GlobalProtect if authentication override is enabled.

Also worth noting: Check Point Remote Access VPN CVE-2026-50751 and LiteLLM CVE-2026-42271 both landed on KEV after this window, so they’ll probably be in next week’s batch.

If you like the format, please consider checking out my newsletter! Link is on my profile page.

https://www.helpnetsecurity.com/2026/06/08/cisa-patch-actively-exploited-solarwinds-serv-u-dos-vulnerability-cve-2026-28318/

CISA says attackers are already exploiting the new SolarWinds Serv-U DoS vulnerability. How are teams prioritizing these types of bugs?

CISA recently added a SolarWinds Serv-U vulnerability (CVE-2026-28318) to its Known Exploited Vulnerabilities catalog after reports of active exploitation. The flaw allows unauthenticated attackers to crash vulnerable Serv-U instances through specially crafted requests.

What caught my attention wasn't the vulnerability itself.

It's how often security teams struggle with prioritizing issues that are "only" denial-of-service vulnerabilities.

A lot of vulnerability programs are understandably focused on RCEs, privilege escalation, credential theft, and ransomware pathways. But services like managed file transfer platforms often sit in critical operational workflows. Taking them offline can still have a significant business impact even if the attacker never achieves code execution.

It raises an interesting operational question:

When an exploited vulnerability is primarily impacting availability, how are you prioritizing remediation?

Are you treating active exploitation as the deciding factor regardless of impact type, or are you still weighting confidentiality and integrity risks much more heavily than availability risks?

I've seen plenty of environments where patch prioritization is driven almost entirely by CVSS scores, yet some of the most disruptive incidents have come from outages affecting systems that weren't considered "high risk" from a traditional breach perspective.

Curious how others are approaching this:

Active exploitation = immediate patching, regardless of vulnerability type? Business criticality first? Exposure-based prioritization? Something else?

Interested in hearing how mature vulnerability management teams are handling these decisions in practice.

SolarWinds Serv-U contains an uncontrolled resource consumption vulnerability that allows specially crafted POST requests using the Content-Encoding: deflate header to crash the Serv-U service without authentication.

SolarWinds Web Help Desk is found to be affected by a denial-of-service vulnerability, which when exploited, could cause the Web Help Desk server to crash due to insufficient memory.

FTP Voyager 16.2.0 contains a denial of service vulnerability that allows local attackers to crash the application by injecting oversized buffer data into the site profile IP field. Attackers can create a malicious site profile containing 500 bytes of repeated characters and paste it into the IP field to trigger a buffer overflow that crashes the FTP Voyager process.

SolarWinds Observability Self-Hosted was found to be affected by a stored cross-site scripting vulnerability, which when exploited, can lead to unintended script execution.

SolarWinds Observability Self-Hosted was found to be affected by a stored cross-site scripting vulnerability, which when exploited, can lead to unintended script execution.

This link covers a cluster of four critical CVEs (all CVSS 9.1) patched in SolarWinds Serv-U 15.5.4, including CVE-2025-40540 — a type confusion remote code execution flaw that can ultimately lead to arbitrary native code execution with elevated privileges.

Quick highlights:

CVE-2025-40540: Type confusion → native code execution as privileged account. Related critical issues in this group include CVE-2025-40538 (broken access control), CVE-2025-40539 (type confusion), and CVE-2025-40541 (IDOR). All require administrative privileges to exploit, but successful abuse can elevate compromising impact significantly. SolarWinds recommends immediate update to Serv-U 15.5.4. No confirmed active exploitation in the wild at publication — but file transfer solutions like Serv-U have a history of being high-value targets.

Actionable for defenders:

Validate Serv-U version exposure across your assets Patch to the latest version immediately Tighten admin access, MFA, and anomaly detection on management interfaces

If anyone has correlation info, exploit IOCs, or hardened detection approaches, post below.

All solarwinders be aware this is a pretty nasty leak out there! advise is to upgrade to 15.5.4

be safe all :)