# SolarWinds Serv-U Hit With Actively Exploited DoS Flaw—CISA Orders Federal Patch Deadline
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has escalated warnings around a high-severity denial-of-service vulnerability in SolarWinds Serv-U, adding the flaw to its Known Exploited Vulnerabilities (KEV) catalog and imposing a June 19, 2026 patch deadline for federal agencies. The move signals active real-world exploitation and underscores continued pressure on organizations running the widely deployed multi-protocol file server software.
## The Threat
CVE-2026-28318 is a resource-exhaustion vulnerability in SolarWinds Serv-U that allows attackers to crash the service without requiring any authentication. The flaw is triggered by specially crafted HTTP POST requests containing a Content-Encoding: deflate header—a seemingly innocuous detail that reveals a dangerous gap in input validation within the application's request handling logic.
When Serv-U processes these malformed requests, the application fails to properly manage resource consumption during the decompression operation, causing the service to exhaust available memory or CPU and crash. This stops file transfer operations completely, disrupting organizations that depend on Serv-U for secure FTP, SFTP, FTPS, and HTTP/HTTPS file transfers. Unlike many application DoS flaws, this one requires no credentials, no prior access, and no social engineering—any attacker on the network (or the internet, if Serv-U is exposed) can trigger the outage.
The vulnerability is particularly concerning in managed service provider (MSP) and enterprise environments where Serv-U often runs on public-facing servers or internet-accessible internal infrastructure. Organizations managing customer transfers, secure document exchange, or automated file distribution workflows face immediate service interruption risk. While the flaw does not enable data theft or system compromise, the availability impact alone can be operationally devastating for businesses relying on uninterrupted file transfer services.
## Severity and Impact
| Attribute | Details |
|---|---|
| CVE Identifier | CVE-2026-28318 |
| CVSS v3.1 Score | 7.5 (High) |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| Vulnerability Type | Denial of Service (Uncontrolled Resource Consumption) |
| CWE | CWE-400 (Uncontrolled Resource Consumption) |
| Authentication Required | No |
| Attack Complexity | Low |
| Attack Vector | Network |
| CISA KEV Status | Added (Active Exploitation Confirmed) |
| Fixed Version | SolarWinds Serv-U 15.5.4 HF1 or later |
The CVSS 7.5 rating reflects the high availability impact (the service goes offline) combined with the trivial attack requirements. The low attack complexity and lack of authentication make this vulnerability exceptionally easy to exploit at scale—an attacker with basic network knowledge can write a single request loop to bring down vulnerable instances. CISA's inclusion in the KEV catalog confirms that threat actors are already weaponizing this flaw in real-world campaigns.
## Affected Products
- Includes all versions up to 15.5.3 and earlier maintenance releases
- No specific version ranges published; organizations should assume all deployed instances require updating unless explicitly running 15.5.4 HF1 or a patched hotfix release
Organizations using Serv-U through MSP agreements or bundled with other SolarWinds products (such as Orion Platform integrations) should verify their specific version immediately.
## Mitigations
Immediate Actions:
1. Upgrade to 15.5.4 HF1 or later — This is the primary remediation. Organizations should prioritize patching over the next 13 days to meet CISA's federal deadline.
2. Block Content-Encoding Headers at the Network Edge — Since the vulnerability is triggered by the Content-Encoding: deflate header and Serv-U does not require this functionality, implement network-level filtering to reject any HTTP/HTTPS requests containing this header before they reach the application:
- Configure web application firewalls (WAF) or reverse proxies (nginx, Apache) to block requests with Content-Encoding: deflate
- Apply rules to both inbound (internet-facing) and internal Serv-U instances if network-exposed
3. Restrict Access to Serv-U Services — Limit network access to Serv-U to known, trusted IP ranges and internal subnets:
- Implement IP whitelisting at the firewall
- Use network segmentation to isolate file transfer systems from untrusted networks
- If Serv-U must be internet-accessible, enforce client certificate authentication and VPN requirements
4. Monitor for Exploitation Attempts — Enable logging and monitor for POST requests with suspicious Content-Encoding headers or unusual traffic spikes toward Serv-U ports (21, 990, 989, 22, 80, 443):
- Baseline normal traffic patterns
- Alert on repeated POST requests from single source IPs
- Review Serv-U logs for service crashes correlated with incoming requests
5. Verify Service Availability — Implement health checks and automated alerts to catch service crashes in real time, ensuring rapid incident response if an attack occurs.
Temporary Workarounds (Until Patching):
If immediate patching is not feasible, combining WAF rule deployment (blocking Content-Encoding: deflate) with strict IP whitelisting significantly reduces attack surface while you test and deploy the official fix. However, this is a temporary measure only—the patch must be prioritized.
## References
---
## HackWire Analysis
This is the second shoe drop in what amounts to a persistent vulnerability pattern in Serv-U. The file transfer software has been a repeated target for threat actors—most notably the Cl0p ransomware gang, which has exploited multiple Serv-U flaws over the past three years to establish initial footholds in enterprise networks. The addition of CVE-2026-28318 to CISA's KEV catalog within days of its public disclosure signals not just a vulnerability, but an *actively weaponized* one.
What's notable here is the simplicity of the attack. Unlike previous Serv-U exploits that required command injection or file upload manipulation, this one is a straightforward resource exhaustion triggered by a single HTTP header. This means the barrier to exploitation is remarkably low—threat actors don't need sophisticated payloads or deep reverse-engineering. A script kiddie with basic HTTP knowledge can participate. This accessibility accelerates adoption across threat actor communities and increases the probability that smaller organizations will face attacks within days rather than weeks.
The timing of CISA's federal deadline (June 19, 2026) is also instructive: they're signaling that federal agencies have been explicitly targeted by attackers exploiting this flaw, and they're imposing urgency to prevent further compromise. For private sector organizations, this is a forcing function. If threat actors are already hitting federal networks, they're almost certainly probing commercial networks as well.
The broader concern is architectural: Serv-U's continued pattern of DoS and RCE vulnerabilities suggests either persistent quality gaps in secure coding practices, or an aging codebase that was never designed with modern threat modeling in mind. Organizations should not treat this as an isolated patch—it's a symptom. Long-term, consider whether Serv-U remains the right choice for critical file transfer infrastructure, or whether migration to alternatives with stronger security track records is warranted.
For defenders: this is a high-confidence patch priority. The CVSS 7.5, lack of authentication, and confirmed active exploitation put this in the "patch today, not next month" category. The mitigation at the WAF layer (blocking Content-Encoding: deflate) provides breathing room for organizations in complex patching windows, but it's not a substitute for the fix.
— HackWire Editorial
## Related Coverage