CVE-2026-28318: SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability
SolarWinds Serv-U contains an uncontrolled resource consumption vulnerability that allows specially crafted POST requests using the Content-Encoding: deflate header to crash the Serv-U service without authentication.
Overview
SolarWinds Serv-U, a managed file transfer product, contains an uncontrolled resource consumption flaw that allows any unauthenticated attacker to crash the service by sending a specially crafted HTTP POST request with a Content-Encoding: deflate header. No credentials or prior access are required. Versions 15.5.4 and earlier are affected. A successful attack takes the file transfer service offline for all users, making this a straightforward denial-of-service against an often internet-facing component.
Vulnerability details
The flaw falls under CWE-400, uncontrolled resource consumption. When Serv-U receives an HTTP POST request bearing a Content-Encoding: deflate header, it attempts to process the encoded body without adequately bounding the resources that processing may consume. A malformed or adversarially constructed deflate payload, such as one designed to exhaust memory or trigger a fault during decompression, causes the service process to crash rather than reject the input gracefully. Because the check occurs before any authentication step, the vulnerable code path is reachable by any network client.
An attacker with network access to the Serv-U service sends a single crafted POST request carrying the Content-Encoding: deflate header. No account, session token, or prior interaction is needed. The service crashes, denying file transfer capability to all connected and subsequent users until the service is restored. Because Serv-U is frequently exposed to the internet to support external file exchange partners, the attack surface is broad and the barrier to exploitation is low.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Monitor Serv-U access logs for POST requests that include a Content-Encoding: deflate header originating from sources with no prior authenticated session. This header combination on unauthenticated requests is abnormal and directly matches the documented exploit mechanism.
- Correlate Serv-U service process termination or restart events in the Windows Event Log (Event ID 7034 or 7036 for service crashes and restarts) with inbound POST requests bearing Content-Encoding: deflate in the preceding seconds, which distinguishes crash-triggering attempts from routine service restarts.
Remediation
Additional hardening
- Upgrade Serv-U to version 15.5.4 Hotfix 1, the release that addresses this vulnerability. Versions 15.5.4 and earlier remain affected; the hotfix is the primary remediation.
- If the patch cannot be deployed immediately, apply the interim mitigations published in the SolarWinds Trust Center advisory, which describe configuration-level steps to protect the service.
- Restrict network access to the Serv-U service to known IP ranges using a firewall or network access control list, reducing the pool of sources that can send unauthenticated POST requests to the deflate handler.
- Place Serv-U behind a reverse proxy or web application firewall configured to reject or strip requests carrying Content-Encoding: deflate from unauthenticated sources, blocking the specific header combination the exploit requires.
Key dates
References
- https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28318
- https://www.solarwinds.com/trust-center/security-advisories/cve-2026-28318
- https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-5-4-hotfix-1_release_notes.htm#link7
- https://nvd.nist.gov/vuln/detail/CVE-2026-28318
- https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-5-4-hotfix-1_release_notes.htm
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-28318
Frequently asked questions
Does CVE-2026-28318 affect my FedRAMP authorization?
If SolarWinds Serv-U runs inside your authorization boundary, yes. CVE-2026-28318 appears in CISA's Known Exploited Vulnerabilities (KEV) catalog, and its June 19, 2026 remediation deadline has already passed. For a FedRAMP-authorized service, an unpatched KEV inside the boundary is a finding. An overdue one is a finding your assessor and sponsoring agency can see right now. Remediate it immediately or formally document the mitigation and the delay.
How does Knox help me handle CVE-2026-28318?
Knox does not patch your software. Remediating SolarWinds Serv-U is your responsibility under the FedRAMP shared-responsibility model. What Knox provides is the pre-authorized, single-tenant boundary to remediate within, along with continuous compliance monitoring and audit-artifact coverage to document the fix for your next assessment. The remediation work is yours to carry out; maintaining a defensible compliance posture while you do it is not something you have to manage on your own.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment for newly disclosed vulnerabilities and compliance issues on an ongoing basis. For a CVE like CVE-2026-28318, that means exposure surfaces during continuous monitoring rather than waiting for an assessor to flag it at a scheduled review.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
CVE-2026-28318's remediation deadline of June 19, 2026 has passed. What happens now?
An unremediated CVE-2026-28318 is already a Plan of Action and Milestones (POA&M) item. A growing POA&M list is what turns a routine continuous-monitoring review into a difficult agency conversation. Closing it out now and documenting the circumstances of the delay is what keeps your authorization standing and the agency relationship intact.
Ready to achieve FedRAMP authorization in 90 days or less?
Schedule a meeting to discuss scope, parse readiness, and map your company’s accelerated path to FedRAMP authorization.
_Horizontal_RGB.png)
