SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability
SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate. Mitigation steps are provided to secure customer environments in the SolarWinds Trust Center if you are unable to deploy the update
MANARTECH SECURITY ALERT
SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability
CVE Numbers
CVE-2026-28318
Affected Product
Serv-U — SolarWinds
Threat Description
SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate. Mitigation steps are provided to secure customer environments in the SolarWinds Trust Center if you are unable to deploy the update
Severity Scale
CRITICALHIGHMEDIUMLOW
Severity
HIGH
Affected Versions
To be reviewed
Recommended Mitigation
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Reference Links
https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-5-4-hotfix-1_release_notes.htm
https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28318
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-28318
https://nvd.nist.gov/vuln/detail/CVE-2026-28318