CVE-2026-28318 SolarWinds Serv-U Uncontrolled Resource Consumption

What is CVE-2026-28318?

CVE-2026-28318 is a high-severity denial of service vulnerability in Solarwinds Serv-U, published on 4 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate. Mitigation steps are provided to secure customer environments in the SolarWinds Trust Center if you are unable to deploy the update

Weakness: CWE-400

Which versions are affected by CVE-2026-28318?

It affects 1 product.

Products include Solarwinds Serv-U.

How do I fix CVE-2026-28318?

No fix has been published for CVE-2026-28318 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 19 Jun 2026.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-28318 being exploited?

Yes. Attackers have exploited CVE-2026-28318 in the wild since at least 5 Jun 2026.

Public exploit code: 2 proofs of concept on GitHub.

Other vulnerabilities in Solarwinds Serv-U

• CVE-2021-35211 SolarWinds Serv-U Remote Code Execution Exploited Critical 9.0
• CVE-2024-28995 SolarWinds Serv-U Path Traversal Vulnerability Exploited High 8.6
• CVE-2021-35247 SolarWinds Serv-U Improper Input Validation Exploited Medium 4.3
• CVE-2020-35481 Code injection in n/a Critical 9.8
• CVE-2026-28302 SolarWinds Serv-U Insecure Direct Object Reference (IDOR) Vulnerability Critical 9.1

All Solarwinds Serv-U vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4vx4-vp54-mwmc.