SolarWinds Serv-U Unauthenticated Remote Denial of Service (DoS) Vulnerability (CVE-2026-28318) Analysis and Mitigation Guide

1. Apply Official Security Patch

Upgrade your Serv-U deployment to Serv-U 15.5.4 Hotfix 1 or later as recommended by the vendor.

• SolarWinds Serv-U 15.5.4 Hotfix 1 Release Notes

2. Temporary Mitigation (If patching is delayed)

If immediate patching is not feasible, apply the following mitigations at the network perimeter:

• WAF Block Rule:

Configure your Web Application Firewall (WAF) to inspect and drop HTTP POST requests containing Content-Encoding: deflate.

  # Snort / Suricata Rule Example
  drop tcp $EXTERNAL_NET any -> $HOME_NET (
      msg:"SolarWinds Serv-U Content-Encoding Deflate DoS Attempt (CVE-2026-28318)";
      flow:established,to_server;
      content:"POST"; http_method;
      content:"Content-Encoding|3a| deflate"; http_header;
      reference:cve,2026-28318;
      classtype:attempted-dos;
      sid:1000001;
      rev:1;
  )

• Network Access Control:

Restrict access to the Serv-U HTTP/HTTPS interfaces to trusted IP ranges or behind a secure VPN.

This vulnerability (CVE-2026-28318) is an uncontrolled resource consumption vulnerability (CWE-400) residing in the HTTP/HTTPS protocol handling engine of SolarWinds Serv-U.

An unauthenticated attacker can exploit this flaw by sending a specially crafted HTTP POST request containing the Content-Encoding: deflate header. When the Serv-U server attempts to decompress the payload, it fails to handle the decompression process safely, leading to an immediate service crash (Denial of Service).

With a CVSS score of 7.5 (High) and low attack complexity, this vulnerability poses a severe threat to service availability. It has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild, which demands immediate remediation.