CVE-2026-28318

SolarWinds Serv-U Unauthenticated Denial of Service Vulnerability

7.5 HighIn KEVPublic exploit

SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate. Mitigation steps are provided to secure customer environments in the SolarWinds Trust Center if you are unable to deploy the update

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

43.7%Up 43.6 points since Jun 5, 2026

What each source reports

CVE List Score used 7.5

SolarWinds Serv-U Unauthenticated Denial of Service Vulnerability

Record: CVE-2026-28318
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-400
Updated: 2026-11-02

EUVDEUVD-2026-34268 7.5

Record: EUVD-2026-34268
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-4vx4-vp54-mwmc 7.5

SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service...

Record: GHSA-4vx4-vp54-mwmc
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-400
Updated: 2026-11-02

CISA KEV No score

SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability

SolarWinds Serv-U contains an uncontrolled resource consumption vulnerability that allows specially crafted POST requests using the Content-Encoding: deflate header to crash the Serv-U service without authentication.

Record: CVE-2026-28318
Weakness: CWE-400
Updated: 2026-11-02

NVD 7.5

Record: CVE-2026-28318
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-400
Updated: 2026-11-02

Affected products

solarwinds serv-u

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	EaEa0001/servu-cve-2026-28318-poc	2026-06-10
PoC in GitHub	BishopFox/CVE-2026-28318-check	2026-06-12

History

History
Recorded	Changed	Sources
Nov 3, 2026	exploitation, exploits
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, CISA KEV, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-28318 is a high vulnerability (CVSS 7.5) in Solarwinds Serv-u, published June 4, 2026. CISA lists it as known to be exploited, since June 5, 2026. EUVD reports exploitation since June 5, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 43.7%, the 98th percentile. No source names a fixed version.