CISA Adds Actively Exploited Solar Winds Serv-U DoS Flaw to KEV Catalog

Summary: CISA added CVE-2026-28318, a high-severity denial-of-service flaw in SolarWinds Serv-U file server software with a CVSS score of 7.5, to its Known Exploited Vulnerabilities catalog citing evidence of active exploitation. SolarWinds said the bug lets unauthenticated specially crafted POST requests using Content-Encoding: deflate crash the service, and it is fixed in Serv-U version 15.5.4 HF1.
Key Takeaway: CISA has ordered Federal Civilian Executive Branch agencies to address the flaw by June 19, 2026, and Serv-U flaws have previously been exploited by actors tied to the Cl0p ransomware gang - with no details yet on who is behind the current exploitation or how many internet-exposed instances are affected.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-28318
Related: CVE-2026-28318: Solar Winds Serv-U Uncontrolled Resource Consumption Vulnerability Known Exploited Vulnerabilities · Jun 05, 2026
⚡ Weekly Recap: Instagram Account Hacks, Android Zero-Day, GitHub Worm and More Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026