The SolarWinds Serv-U file transfer software contains a high-severity denial-of-service vulnerability (CVE-2026-28318) caused by uncontrolled resource consumption triggered by specially crafted POST requests with Content-Encoding: deflate headers. This flaw allows remote attackers to crash the Serv-U service without authentication or user interaction. SolarWinds released Serv-U 15.5.4 Hotfix 1 to patch this vulnerability. CISA has confirmed active exploitation in the wild and added the vulnerability to its Known Exploited Vulnerabilities Catalog, issuing a binding directive for federal agencies to patch promptly. Mitigations include applying the official patch or restricting access and blocking POST requests with content-encoding headers. Thousands of Serv-U servers remain exposed online, with unknown patch coverage. This vulnerability continues a trend of Serv-U being targeted by threat actors for various exploits.

Exploitation of this vulnerability results in denial-of-service conditions by crashing the Serv-U service, disrupting file transfer operations. The attack requires no authentication and is low complexity, enabling remote attackers to cause service outages. This poses significant operational risks to organizations relying on Serv-U for managed file transfers. CISA's inclusion of this vulnerability in the Known Exploited Vulnerabilities Catalog and the issuance of a binding directive for federal agencies underscore its critical impact. While no data theft or remote code execution is described for this flaw, service disruption can affect business continuity and availability.

SolarWinds has released Serv-U 15.5.4 Hotfix 1 as an official fix for this vulnerability; applying this patch is the primary remediation. For organizations unable to immediately patch, SolarWinds recommends limiting access to known IP addresses and blocking any POST requests containing the "content-encoding" header, as the vulnerable Serv-U service does not require this functionality. CISA mandates U.S. federal agencies to patch by June 19, 2026, and urges all network defenders to secure their environments accordingly. No other mitigations are indicated by the vendor or CISA.