CVE-2026-28318

Summary

SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate. Mitigation steps are provided to secure customer environments in the SolarWinds Trust Center if you are unable to deploy the update

Affected Software

Weaknesses

• CWE-400: CWE-400 Uncontrolled Resource Consumption

Workarounds

Block any POST requests containing 'Content-Encoding: deflate'. This function is not required for SolarWinds Serv-U.

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: active
  • Automatable: yes
  • Technical Impact: partial

Additional References

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-28318

References

• https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28318
• https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-5-4-hotfix-1_release_notes.htm

• ←Previous
• Next→