{"id":"CVE-2026-28318","title":"SolarWinds Serv-U Unauthenticated Denial of Service Vulnerability","summary":"SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate. Mitigation steps are provided to secure customer environments in the SolarWinds Tru…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-400"],"vendor":"SolarWinds","product":"Serv-U","affected":["Serv-U <= 15.5.4"],"ssvc":{"exploitation":"active","automatable":"yes","technicalImpact":"partial","timestamp":"2026-06-05T00:00:00+00:00"},"exploited":true,"exploitAvailable":true,"published":"2026-06-04","updated":"2026-10-21","sourceUpdated":"2026-10-21T10:29:06.114Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-28318","references":[{"url":"https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28318"},{"url":"https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-5-4-hotfix-1_release_notes.htm"}],"tags":["cve.org","in-the-wild","exploit-available","kev"],"epss":0.01942,"epssPercentile":0.79863,"kev":true,"kevDateAdded":"2026-06-05","kevDueDate":"2026-06-19","kevRansomware":false,"exploits":{"github":2,"githubRepos":["https://github.com/EaEa0001/servu-cve-2026-28318-poc","https://github.com/BishopFox/CVE-2026-28318-check"],"checkedAt":"2026-10-21T10:46:59.308Z"},"zeroDay":true,"ingestedAt":"2026-10-21T10:46:55.413Z","slug":"CVE-2026-28318","body":"## Overview\n\nSolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate. Mitigation steps are provided to secure customer environments in the SolarWinds Trust Center if you are unable to deploy the update\n\n## Affected\n\n- `Serv-U <= 15.5.4`\n\n## Remediation\n\nUpgrade to SolarWinds Serv-U 15.5.4 Hotfix 1. Use the mitigation steps until the upgrade is possible.\n\n### Workarounds\n\nBlock any POST requests containing 'Content-Encoding: deflate'. This function is not required for SolarWinds Serv-U.","depth":"abyssal","depthScore":67,"depthScoreParts":{"impact":41.3,"likelihood":0.4,"exploitation":25,"ransomware":0},"changes":[]}