CVE-2026-28318High· 7.5▾ Abyssal⚠ Exploited in the wild0dayPoC availableSolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate. Mitigation steps are provided to secure customer environments in the SolarWinds Tru…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 41.3 · likelihood 0.4 · exploitation 25
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Federal remediation due Jun 19, 2026
Last analysed / modified upstream
1.9%
2 GitHub repos (last check)
Added to the CISA catalog on Jun 5, 2026. Federal remediation due Jun 19, 2026. View catalog ↗
SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate. Mitigation steps are provided to secure customer environments in the SolarWinds Trust Center if you are unable to deploy the update
Serv-U <= 15.5.4Upgrade to SolarWinds Serv-U 15.5.4 Hotfix 1. Use the mitigation steps until the upgrade is possible.
Block any POST requests containing 'Content-Encoding: deflate'. This function is not required for SolarWinds Serv-U.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-40551Critical· 9.8SolarWinds Web Help Desk Deserialization of Untrusted Data Remote Code Execution Vulnerability
CVE-2025-26399Critical· 9.8SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine
CVE-2025-40548Critical· 9.1A missing validation process exists in Serv U when abused, could give a malicious actor with access to admin privileges the ability to execute code
CVE-2026-28326High· 8.8SolarWinds Access Rights Manager was reported to be affected by an unauthenticated remote code execution vulnerability
CVE-2026-28328High· 8.8SolarWinds Observability Self-Hosted broken authorization schema
CVE-2026-28330Medium· 4.6SolarWinds Observability Self-Hosted Cross-Site Scripting Vulnerability