CVE-2026-28318
Act now ● On CISA KEV — actively exploited
Actively exploited — on the CISA KEV list.
CVSS base
7.5
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS — probability of exploitation (30 days)
40.0%
98.6th percentile
CISA KEV
Listed
Added 2026-06-05 · patch by 2026-06-19
Weakness / dates
CWE-400
Published 2026-06-04 · modified 2026-07-22
Description
SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate. Mitigation steps are provided to secure customer environments in the SolarWinds Trust Center if you are unable to deploy the update