CVE-2026-28318

HighCVSS 7.5/10Known exploited (CISA KEV)Last modified Oct 21, 2026

Description

SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate. Mitigation steps are provided to secure customer environments in the SolarWinds Trust Center if you are unable to deploy the update

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
SolarWinds	Serv-U	<= 15.5.4

References

https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-5-4-hotfix-1_release_notes.htmRelease Notes
https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28318Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-28318US Government Resource

Timeline

Published: Jun 4, 2026
Last modified: Oct 21, 2026
Added to CISA KEV: Jun 5, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-28325.3Certain Samsung MultiXpress Multifunction Printers may be vulnerable to information disclosure, potentially exposing address book entries an CVE-2026-283219.1SolarWinds Serv-U is affected by a broken access control vulnerability that could allow arbitrary file read and write, which can then be use CVE-2026-283225.6SolarWinds Database Performance Analyzer was found to be affected by a stored cross-site scripting vulnerability, which when exploited, can CVE-2026-283239.8SolarWinds Web Help Desk is found to be affected by a SAML authentication bypass vulnerability. This requires the SAML 2.0 authentication me CVE-2026-283249.8SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability due to the insuffici CVE-2026-283258.8SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability stemming from deseri CVE-2026-283268.8SolarWinds Access Rights Manager was reported to be affected by an unauthenticated remote code execution vulnerability. The issue stems from CVE-2026-283278.2SolarWinds Dameware was found to be affected by a DLL hijacking vulnerability. The hijack occurs during installations only and requires acce CVE-2026-283288.8SolarWinds Observability Self-Hosted was found to be affected by a broken authorization schema that can allow low-privileged users to access CVE-2026-283296.4SolarWinds Observability Self-Hosted was found to be affected by a Server-Side Request Forgery (SSRF) vulnerability that allows authenticate CVE-2026-28339.1An HTTP request smuggling vulnerability (CWE-444) was found in Pingora's handling of HTTP/1.1 connection upgrades. The issue occurs when a P CVE-2026-283304.6SolarWinds Observability Self-Hosted was found to be affected by a stored Cross-Site Scripting (XSS) vulnerability that allows authenticated