SolarWinds published its advisory for CVE-2026-28318 on 3 June 2026. Two days later, on 5 June, CISA added it to the Known Exploited Vulnerabilities catalog with a federal deadline of 19 June.
An unauthenticated attacker sends specially crafted POST requests with Content-Encoding: deflate, and the Serv-U service crashes. Nothing is stolen, but a file transfer server that falls over on demand is an outage anyone can cause.
What's affected
Serv-U 15.5.4 and earlier. The fix is Serv-U 15.5.4 HF1. SolarWinds rates it 7.5 (High), availability impact only, and NVD classes it as CWE-400, uncontrolled resource consumption. Public details about the attacks are thin, and I found no named threat actor in the sources.
What to do now
- Install Serv-U 15.5.4 HF1.
- If you cannot patch yet, use the two controls SolarWinds lists: restrict access to known IP addresses, and block POST requests that carry a
content-encodingheader, because the service does not need that. - Watch for repeated crashes of the Serv-U process and for POSTs with that header from external addresses.
An nginx front end can block the header on POST requests:
map "$request_method:$http_content_encoding" $block_encoded_post {
default 0;
"~^POST:.+" 1;
}
# inside the location that proxies to Serv-U
if ($block_encoded_post) { return 403; }
SolarWinds also publishes example rules for several WAFs, and notes that they should be confirmed with your WAF vendor.
How this could have been avoided
- Do not publish file transfer servers wide open. An allowlist of partner addresses means a stranger cannot send the request at all.
- Put a proxy in front. A reverse proxy or WAF can reject request features the service never uses, such as encoded POST bodies, long before they reach the vulnerable parser.
- Run it under a supervisor with alerts. Automatic restart limits the outage, and an alert on repeated crashes tells you someone is probing.
Quick check
What header combination triggers the crash?
A crafted POST request with Content-Encoding: deflate, sent to a Serv-U version up to 15.5.4 with no login.
