Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
🛡️
CISA KEV · ACTIVELY EXPLOITED
HIGH severity

CVE-2026-28318 — SERV-U

HIGH

CVE-2026-28318 is a high-severity (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in solarwinds serv-u. It is in CISA's Known Exploited Vulnerabilities catalog (added 2026-06-05) — treat it as actively exploited and patch now. A fix is available — see the affected versions and patch details below.

SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate. Mitigation steps are provided…

Published
Updated
Affected
1 product
Patched
See advisory
Exploits
None indexed
Exploitation data as of Oct 23, 2026 · OSV.dev, NVD, CISA KEV, FIRST.org (EPSS)

Exploitation Status

Actively exploited in the wild

  • Confirmed by CISA's Known Exploited Vulnerabilities catalog on 2026-06-05. Federal agencies were required to remediate by 2026-06-19.
  • CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.

Exploitation and automatability from CISA (KEV catalog and SSVC triage) for CVE-2026-28318.

EPSS Exploitation Probability

via FIRST.org ↗
43.7%probability of exploitation in next 30 days
High Risk+41.71%
Lower risk than most CVEs99th percentile — riskier than 99% of all scored CVEsHighest risk
0.00%18.7%37.4%56.2%10.7%8.4%40.0%1.9%43.7%Jul 26Sep 26Oct 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

CVE-2026-28318 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.

Where this sits among everything scored

Of 395,249 CVEs with a current EPSS score, this one falls in the 10–50% band (highlighted). Counts from FIRST.org, log-scaled.

Description

SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate. Mitigation steps are provided to secure customer environments in the SolarWinds Trust Center if you are unable to deploy the update

Affected Products

1 product · 2 configurations
Application
serv-usolarwinds
< 15.5.4
1 version
15.5.4

Detection & mitigation playbook

Vendor / appliance

  1. Detect

    Inventory every solarwinds serv-u deployment and check each version against the affected-products list above.

  2. Fix

    Apply the solarwinds serv-u security patch or hotfix for CVE-2026-28318 on the affected version, following the vendor advisory for your exact build.

  3. Workarounds

    Cap what an attacker can consume: apply request size, rate and timeout limits in front of the affected component, and run it with memory and CPU limits so exhaustion degrades one worker rather than the whole service. Alongside that, restrict the management interface to trusted networks and apply the vendor's recommended configuration mitigations.

Frequently Asked Questions

SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate. Mitigation steps are provided to secure customer environments in the SolarWinds Trust Center if you are unable to deploy the update
O3 Security · Runtime Protection

Is CVE-2026-28318 being exploited in your environment?

Detect and block the exploit chain at execution, on systems you cannot patch yet.

Protect my workloads How runtime protection works
Actively Exploited: CVE-2026-28318: SERV-U (High 7.5)