CVE-2026-28318 — SolarWinds Serv-U: Resource Exhaustion | CVSS 7.5 HIGH

HIGH

CVSS 7.5 HIGH  ·  EPSS 0%  ·  SolarWinds Serv-U

Severity Overview

Summary

SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate. Mitigation steps are provided to secure customer environments in the SolarWinds Trust Center if you are unable to deploy the update

What the Attack Looks Like

How it works: An attacker sends crafted requests that cause the application to consume excessive CPU, memory, or disk resources, degrading or denying service to legitimate users.

If successfully exploited: High availability impact means the vulnerability can also cause a denial of service, which may be used for disruption or as a diversion during a broader attack.

Analyst Takeaway

The attack is launched over the network (remotely exploitable without physical access) and no authentication is required. This vulnerability is already in CISA KEV, which means exploitation has been confirmed in the wild — treat this as active risk, not theoretical exposure. In parallel with patching, defenders should review external exposure, hunt for signs of exploitation, and validate whether compensating controls are in place for vulnerable assets.

Detection Guidance

• CWE-400 — Uncontrolled Resource Consumption
  • Resource utilization monitoring: Watch for sustained spikes in CPU, memory, or thread pool consumption on the affected service host correlated with inbound requests. A single source driving resource exhaustion is a strong exploitation indicator.
  • Request pattern analysis: Look for unusually large request payloads, deeply nested data structures, or specially crafted input that causes the application to perform excessive computation. These patterns are often consistent across multiple exploitation attempts.
  • Availability impact timeline: Document when the service became degraded and cross-reference with inbound traffic at that time. If service degradation correlates with traffic from a specific IP or ASN, that source warrants investigation.

Recommended Actions

Immediate (0–24 Hours)

• Inventory: Identify all systems running SolarWinds Serv-U. Include production, staging, dev, and cloud environments — untracked instances are the most likely to remain unpatched.
• Validate internet-facing exposure: Determine which of the affected systems are reachable from the public internet. Prioritize these for immediate remediation or compensating controls.

Remediation

• Apply the vendor patch: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
• CISA directive deadline: 2026-06-19 — this is the mandatory deadline for US federal civilian agencies under BOD 22-01. All organizations should treat this date as a strong target regardless of federal mandate.
• Verify remediation: After patching, confirm the correct version is installed on all affected hosts. Run a vulnerability scan or use your asset management tooling to verify — do not rely solely on change tickets.

Detection Coverage

• Unauthenticated exploitation monitoring: Because this vulnerability requires no authentication, internet-facing scanning and exploitation attempts may begin within hours of public disclosure. Ensure alerting is in place before the end of the day.
• Threat intelligence feeds: Monitor your TI feeds and vendor advisory channels for published indicators of compromise (IOCs), proof-of-concept exploit releases, or active campaign reporting associated with this CVE — these should trigger an immediate hunt even if no internal alerts have fired.

Vulnerability Details

Additional Notes

https://www.solarwinds.com/trust-center/security-advisories/cve-2026-28318 ; https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-5-4-hotfix-1_release_notes.htm#link7 ; https://nvd.nist.gov/vuln/detail/CVE-2026-28318