Actively exploited in the wild
SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability
SolarWinds - Serv-U · Listed in the CISA KEV since 2026-06-05. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2026-28318
HighCVSS 7.5KEVExploitation Probability (EPSS)
Very high risk95th percentile - higher than 95% of all known CVEs
Summary
SolarWinds Serv-U is susceptible to specially crafted POST requests with Content-Encoding: deflate that crash the Serv-U service without authentication.
Risk Assessment
An attacker can cause a denial of service (DoS) by crashing the Serv-U service, potentially leading to file access disruption.
Recommendation
Apply the update or follow mitigation steps provided in the SolarWinds Trust Center.
Other vulnerabilities in SolarWinds Serv-U
See all- CVE-2026-28321Critical
SolarWinds Serv-U suffers from a broken access control vulnerability that allows arbitrary file read/write, privilege escalation, and code execution as root. Domain administrator access is required; impact is lower on Windows.
- CVE-2026-28317Critical
SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation. Requires domain administrator access. Impact is lower in Windows deployments.
- CVE-2026-28316Critical
SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation to a system administrator with the ability to execute commands as the root user. This issue requires a domain account with administrator access. The impact is lower in Windows deployments.
- CVE-2026-28314Critical
Vulnerability in SolarWinds Serv-U involving insecure direct object reference (IDOR) allows account takeover. Authentication is required, impact is lower on Windows deployments.
- CVE-2026-28313Critical
SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to SMTP hijacking leading to arbitrary account takeover. Impact is lower in Windows deployments.
- CVE-2026-28312Critical
Privilege escalation vulnerability in SolarWinds Serv-U. An attacker can elevate group privileges to system administrator and execute code as root. Impact is lower on Windows.
- CVE-2026-28310Critical
SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to escalate their user type to that of a system administrator. Impact is lower in Windows deployments.
- CVE-2026-28309Critical
SolarWinds Serv-U is affected by a broken access control vulnerability that allows a domain administrator to create system administrator accounts. Impact is lower in Windows deployments.
- CVE-2026-28308Critical
SolarWinds Serv-U is affected by an IDOR vulnerability that can lead to remote code execution. Domain administrator access is required. Impact is lower on Windows deployments.
- CVE-2026-28307Critical
SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain user group to be elevated into an administrator group. Impact is lower in Windows deployments.
Original NVD description (English source)
SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate. Mitigation steps are provided to secure customer environments in the SolarWinds Trust Center if you are unable to deploy the update
Vulnerability data from NVD (NIST) · CISA KEV · EPSS