CVE-2026-28318

Description

SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate. Mitigation steps are provided to secure customer environments in the SolarWinds Trust Center if you are unable to deploy the update

Scoring

• CVSS: 7.5 (HIGH, 3.1)
• EPSS exploitation probability: Not yet available
• EPSS percentile: Not yet available

CISA KEV status

• Added to KEV: 2026-06-05
• Remediation due date: 2026-06-19
• Known ransomware campaign use: Unknown

Weakness types (CWE)

• CWE-400

References

• https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-5-4-hotfix-1_release_notes.htm
• https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28318
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-28318

More from SolarWinds

• CVE-2025-26399 — Web Help Desk
• CVE-2025-40536 — Web Help Desk
• CVE-2025-40551 — Web Help Desk
• CVE-2024-28987 — Web Help Desk
• CVE-2024-28986 — Web Help Desk