CISA Warns Hackers Exploit Patched SolarWinds Serv-U Flaw

The U.S. Cybersecurity and Infrastructure Security Agency reported that threat actors are now exploiting a high-severity denial-of-service vulnerability in SolarWinds Serv-U file transfer software.

CISA adds Serv-U flaw to Known Exploited Vulnerabilities Catalog. Days after the vendor issued a fix, CISA added the bug to its catalog of actively exploited vulnerabilities and directed all Federal Civilian Executive Branch agencies to apply patches by June 19 under Binding Operational Directive 22-01.

Although the directive targets only federal agencies, CISA called on all network defenders in the public and private sectors to address ongoing attacks targeting CVE-2026-28318 without delay.

Serv-U vulnerability enables unauthenticated denial-of-service attacks. SolarWinds shipped Serv-U 15.5.4 Hotfix 1 on Thursday to correct the flaw, which arises from uncontrolled resource consumption. The vendor stated the issue allows specially crafted POST requests using "Content-Encoding: deflate" to crash the service without requiring authentication.

Exploitation can occur remotely, without privileges or user interaction, and with low attacker complexity.

SolarWinds issues temporary mitigations for unpatched systems. The company told administrators unable to install the update immediately to restrict access to trusted IP addresses and to drop any POST request that includes a "content-encoding" header, noting that the affected Serv-U versions do not depend on this feature.

CISA described such bugs as common entry points for malicious actors that create substantial risk to federal networks. The agency recommended following vendor guidance, adhering to BOD 22-01 cloud directives where applicable, or stopping use of the product when fixes cannot be applied.

Thousands of Serv-U servers remain exposed online. Shodan lists more than 12,000 internet-facing Serv-U instances, while Shadowserver reports just over 3,100. No data is available on the share that have received the latest patch.

Serv-U flaws repeatedly targeted by multiple threat actors. Multiple criminal and nation-state groups have repeatedly abused Serv-U weaknesses in recent years to exfiltrate corporate and customer information. The Clop ransomware operation leveraged a remote code execution bug in a 2021 intrusion wave, and the Chinese hacking team tracked as DEV-0322 used the same flaw in zero-day attacks that began in July 2021.

In June 2024, GreyNoise and Rapid7 both identified active exploitation of a separate Serv-U path-traversal vulnerability. Across various SolarWinds offerings, CISA has cataloged 11 exploited vulnerabilities over the past several years, at least one of which ransomware operators have also weaponized.