Vulnerability

CERT-In Vulnerability Note CIVN-2026-0297
Denial of Service Vulnerability in SolarWinds Serv-U

Original Issue Date:June 09, 2026

Severity Rating: HIGH

Software Affected

SolarWinds Serv-U 15.5.4

Overview

A vulnerability has been reported in SolarWinds Serv-U which could be exploited by an attacker to cause denial of service attack on the targeted system.

Target Audience:
All organizations and individuals using SolarWinds products.

Risk Assessment:
Critical risks of service disruption.

Impact Assessment:
Potential for disruption of service, system compromise.

Description

SolarWinds Serv-U is an FTP server solution for secure, automated, and centralized file transfers, supporting FTP, FTPS, SFTP, and HTTP/S, as well as remote management and optional web-based file transfer access in the Managed File Transfer (MFT) edition.

This vulnerability exists in SolarWinds Serv-U due to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate.

Successful exploitation of this vulnerability could allow an attacker to cause denial of service attack on the targeted system.

Solution

Apply appropriate updates as mentioned by the vendor:
http://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-5-4-hotfix-1_release_notes.htm

Vendor Information

SolarWinds
http://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-5-4-hotfix-1_release_notes.htm

References

SolarWinds
http://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-5-4-hotfix-1_release_notes.htm

CVE Name
CVE-2026-28318

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India