en.Wedoany.com Reported - The US Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that attackers are exploiting a vulnerability (CVE-2026-28318) that can crash SolarWinds Serv-U file transfer servers. The agency has ordered US federal civilian agencies to remediate the vulnerability by June 19, 2026, either by installing a patch or implementing mitigation measures.
CVE-2026-28318 is an uncontrolled resource consumption vulnerability that can be triggered by a remote unauthenticated attacker. The flaw exists in the way the Serv-U service processes HTTP POST requests containing a Content-Encoding: deflate header. By sending a specially crafted request, an attacker can force Serv-U to consume excessive resources, causing the service to crash and resulting in a denial of service condition. The vulnerability was disclosed by SolarWinds on June 3, following the release of Serv-U 15.5.4 Hotfix 1 to address the issue. SolarWinds stated that customers who have downloaded and installed Serv-U 15.5.4 should also download and install Serv-U 15.5.4 Hotfix 1. Alternatively, users can use a web application firewall to restrict server access to known addresses only and block POST requests containing content-encoding, as the service does not require this functionality.
A remote code execution vulnerability (CVE-2021-35211) affecting SolarWinds Serv-U software was previously exploited as a zero-day by suspected Chinese attackers for cyber espionage, and later by the Cl0p ransomware group. In 2022, an input validation vulnerability (CVE-2021-35247) was exploited in attacks related to Log4j. Two years ago, CVE-2024-28995 was also exploited by attackers. CISA has not yet provided details on the in-the-wild exploitation of CVE-2026-28318, and there is currently no indication that the vulnerability is being exploited by ransomware groups.
SolarWinds Serv-U is a self-hosted solution that allows organizations to securely transfer files over a network. It is commonly used by organizations in regulated industries and sectors such as healthcare, finance, and government, which require data sovereignty and audit trails. While attackers prefer vulnerabilities that can fully compromise a Serv-U deployment, denial of service vulnerabilities can be used to disrupt organizational operations or divert the attention of enterprise defenders from other covert activities.
This article is compiled by Wedoany. All AI citations must indicate the source as "Wedoany". If there is any infringement or other issues, please notify us promptly, and we will modify or delete it accordingly. Email: news@wedoany.com
