CVE-2026-28318KEV · OVERDUECWE-400denial-of-service

SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability

High · published June 4, 2026

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.5. It is confirmed in active exploitation. It sits in the 98.7th percentile for exploit probability.

128
days past CISA
deadline
CVSS v3.1
7.5
EPSS
44%
Percentile
98.7
In the wild
Confirmed
What it is

SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate. Mitigation steps are provided to secure customer environments in the SolarWinds Trust Center if you are unable to deploy the update

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.43651 · 98.7th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2026-06-04T19:16Z
KEV added
2026-06-05 · due 2026-06-19
Affected products (2)
ProductVersionsFixed in
solarwinds/serv-u< 15.5.415.5.4
solarwinds/serv-uall versions—
References (3)
https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-5-4-hotfix-1_release_notes.htm · [email protected]https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28318 · [email protected]https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-28318 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 23 OCT 03:58Z
    EPSS moved 2% → 44%
    epss
  • 25 SEP 03:25Z
    EPSS moved 40% → 2%
    epss
  • 05 JUN 00:00Z
    Added to CISA KEV — remediate by Jun 19
    kev
  • 04 JUN 14:05Z
    SolarWinds Serv-U Unauthenticated Denial of Service Vulnerability
    cvelistv5