Denial-of-service flaw in SolarWinds Serv-U (CVE-2026-28318) — crashing file transfer without authentication
SolarWinds Serv-U, a file-transfer server, has an uncontrolled-resource-consumption (DoS) flaw: without authentication, a crafted POST request using a deflate Content-Encoding header can crash the Serv-U service. CISA listed it as known-exploited (KEV) (CVSS 7.5 High, per NVD).
Key facts
- CVE IDCVE-2026-28318
- CVSS base score7.5 HIGH
- CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Affected (vendor / product)SolarWinds Serv-U
- CWECWE-400
- ExploitationListed in CISA KEV (exploitation confirmed)
- Remediation due2026-06-19 (U.S. federal civilian agencies, BOD 22-01)
Key points
- Uncontrolled resource consumption (CWE-400) in SolarWinds Serv-U (a file-transfer server)
- Without authentication, a crafted deflate-encoded POST can crash the service (DoS)
- Impact is availability only (not data theft), but it can halt core file exchange
- Listed in CISA KEV = exploitation confirmed; CVSS 7.5 High, per NVD
- Response: apply SolarWinds' fix and review exposure (remediation deadline June 19, 2026)
- A crafted request using Content-Encoding: deflate exhausts resources and stops the file transfer service.
1SolarWinds Serv-U as transfer infrastructure
CVE-2026-28318 is an uncontrolled-resource-consumption vulnerability (CWE-400) in SolarWinds Serv-U (a widely used file-transfer server providing MFT — managed file transfer — and FTP).
2Abusing Content-Encoding
Per public information, an unauthenticated attacker can crash the Serv-U service by sending a specially crafted POST request using the Content-Encoding: deflate header. This is a denial-of-service (DoS) — deliberately exhausting the server's processing resources to bring it down.
3Availability-only impact as a condition
The impact is availability only (no confidentiality or integrity impact — data is not stolen). However, file transfer often underpins core business (data exchange with partners, batch integrations), so an outage halts operations. Serv-U has been a target before, so CISA listing it as known-exploited carries weight.
4Exhausting the resources to stop it
The outcome here is denial of service. Nothing is stolen; the server's processing resources are deliberately exhausted until it stops.
- 1Send a crafted POST requestUsing a Content-Encoding: deflate header
- 2Resources are exhaustedUncontrolled resource consumption (CWE-400) occurs
- 3The service crashesThe Serv-U service stops
- 4The business stopsData exchange with partners and batch integrations lose their support
Impact is to availability only, with none to confidentiality or integrity. File transfer nonetheless underpins core business in many organisations, and stopping it stops the work. Serv-U has been attacked before, which gives weight to CISA listing it as confirmed exploited. Where it is exposed to the internet the priority rises, and reviewing that exposure and tightening access control belong in the response.
Why it matters
Concerns the availability of organizations using Serv-U for partner data exchange and system integration. Because an outage can be triggered remotely without authentication, prompt patching plus minimizing exposure and strengthening access control are the priorities. It underscores protecting core file-transfer infrastructure.
FAQ
What is Serv-U?
If it is only DoS, is it minor?
What should I do?
Sources (primary)
This article is an independent organization based on the U.S. official data below. Always verify the exact, latest details and applicability with the official and vendor sources.
- CISA KEV Catalog (known exploited list)
- NVD (CVE details / CVSS)
- Vendor / reference advisory
- Vendor / reference advisory
- This product uses data from the NVD API but is not endorsed or certified by the NVD. KEV data is CC0 (public domain).