CVE-2026-28318

What it actually does

CVE-2026-28318 is an unauthenticated network denial-of-service vulnerability in SolarWinds Serv-U. A remote attacker can send specially crafted HTTP POST requests using the header `Content-Encoding: deflate` to trigger a Serv-U service crash. The vulnerability does not provide code execution or data access based on the supplied details, but it can cause high availability impact because the file transfer service can be repeatedly crashed without credentials or user interaction.

Why it matters to the business

Organizations using SolarWinds Serv-U may experience outages of FTP/SFTP/file-transfer services, failed automated transfers, disrupted partner integrations, missed operational deadlines, and increased support burden. Because this vulnerability is listed in CISA KEV, has active in-the-wild exploitation, and has a CISA remediation due date of 2026-06-19, exposed internet-facing deployments should be treated as urgent even though the known impact is denial of service rather than ransomware or data theft.

How an attack unfolds

An attacker first identifies an internet-accessible SolarWinds Serv-U service. Without authenticating, the attacker sends a malformed or specially crafted HTTP POST request that includes `Content-Encoding: deflate`. Vulnerable Serv-U versions mishandle the request and the Serv-U service crashes. The attacker can repeat the request to keep the service unavailable, interfere with business file transfers, or combine the outage with other activity intended to distract defenders. Active exploitation has been reported in the wild, so organizations should assume opportunistic scanning and exploitation attempts may occur against exposed Serv-U endpoints.

How to fix it

Apply the SolarWinds Serv-U security update or vendor-provided fixed release as soon as it is available for the deployed product line. No exact fixed version was provided in the input, so administrators should consult the SolarWinds advisory and Trust Center for the authoritative patched builds and mitigation steps. If immediate patching is not possible, restrict Serv-U exposure to trusted networks, block untrusted access to Serv-U web interfaces, place the service behind a filtering reverse proxy or WAF where feasible, monitor and rate-limit suspicious POST traffic, and implement the vendor’s temporary mitigations. Ensure service auto-restart is configured only as a resilience measure; it does not remediate the vulnerability.

How to confirm the fix worked

Confirm the deployed Serv-U version is at or above the vendor-designated fixed version or that SolarWinds-recommended mitigations are in place. Verify that Serv-U management and web interfaces are not broadly internet-exposed unless required. Review perimeter controls to ensure only trusted sources can reach the service. Validate that HTTP requests with `Content-Encoding: deflate` are logged, filtered, or handled safely according to the vendor guidance. Do not validate by sending a crashing exploit to production; use a patched test environment or vendor-supported verification method. After remediation, monitor for absence of recurring Serv-U process crashes, Windows service termination events, and repeated unauthenticated POST requests containing `Content-Encoding: deflate`.

Typical attack path

1. Scan the internet or target network ranges for exposed SolarWinds Serv-U HTTP/S management or file-transfer interfaces.
2. Confirm the target appears to be Serv-U or responds like a Serv-U service.
3. Send an unauthenticated crafted HTTP POST request containing `Content-Encoding: deflate`.
4. Trigger a Serv-U service crash on vulnerable versions.
5. Repeat requests to sustain a denial-of-service condition or time the outage to disrupt business operations.

How to detect it

Hunt for signs that Serv-U crashed shortly after unauthenticated HTTP POST requests containing `Content-Encoding: deflate`. Relevant sources include web access logs in front of Serv-U, reverse proxy/WAF logs, firewall logs, EDR telemetry, Windows Application and System event logs, Serv-U application logs, service control manager events, and crash dumps. Look for repeated POST requests from the same or rotating external IPs, especially requests with unusual compressed request bodies, missing authentication context, abnormal user agents, or 4xx/5xx responses followed by a Serv-U process termination. On Windows, correlate `Serv-U.exe` crashes, Application Error events, Windows Error Reporting entries, and Service Control Manager events showing the Serv-U service terminated unexpectedly. If exposed to the internet, also review network telemetry for spikes in short-lived HTTP/S sessions to the Serv-U listener followed by service unavailability. Because the known impact is denial of service, successful exploitation evidence is more likely to appear as crash/restart artifacts and availability gaps than as persistence, lateral movement, or data staging.

• Content-Encoding: deflate
• POST
• Faulting application name: Serv-U.exe
• Serv-U.exe
• Serv-U File Server service terminated unexpectedly
• The Serv-U File Server service terminated unexpectedly
• Event ID 1000
• Event ID 7031
• Windows Error Reporting
• Application Error
• C:\Program Files\RhinoSoft\Serv-U\Serv-U.exe
• SolarWinds Serv-U

What your security team should do

• Prioritize remediation immediately for any internet-facing SolarWinds Serv-U instance because the vulnerability is in CISA KEV and is reported as actively exploited in the wild.
• Identify all SolarWinds Serv-U deployments, including externally exposed, partner-facing, and legacy file-transfer servers.
• Apply the vendor security update or fixed release; if not immediately possible, implement SolarWinds Trust Center mitigations and restrict access to trusted IP ranges.
• Add temporary detection and blocking for unauthenticated HTTP POST requests to Serv-U endpoints that include `Content-Encoding: deflate`.
• Review logs for the period since publication on 2026-06-04, with emphasis on repeated service crashes or suspicious POST traffic preceding crashes.
• Ensure Serv-U service monitoring, alerting, and restart procedures are in place to reduce outage duration while remediation is underway.
• Report remediation status against the CISA KEV due date of 2026-06-19 where applicable to regulatory or federal compliance programs.