CISA has added a SolarWinds Serv-U vulnerability, tracked as CVE-2026-28318, to its Known Exploited Vulnerabilities catalog after evidence of active exploitation. The flaw affects SolarWinds Serv-U multi-protocol file server software and can allow unauthenticated attackers to crash the Serv-U service through specially crafted POST requests using `Content-Encoding: deflate`. SolarWinds has fixed the issue in Serv-U version 15.5.4 HF1. ([The Hacker News][1]) 

Why this matters 

Serv-U is commonly used for managed file transfer, FTP, FTPS, SFTP, and web-based file exchange. These systems often handle sensitive business data, customer files, partner uploads, and internal documents. Even though this specific vulnerability is a denial-of-service flaw rather than remote code execution, it still matters because availability is critical for file-transfer services. If attackers can repeatedly crash the service, they can disrupt business operations, delay file exchange, and create pressure during critical workflows. Because naturally, attackers understand uptime better than some patch calendars do.

CISA has directed U.S. federal agencies to remediate the issue by June 19, 2026, under its KEV process. That timeline should also be a signal for private organizations: when CISA adds a vulnerability to KEV, it is no longer just a theoretical bug sitting politely in a scanner report. It is being exploited. 

What organizations should do 

Organizations using SolarWinds Serv-U should immediately identify exposed instances and upgrade to Serv-U 15.5.4 HF1 or later. If patching cannot be done immediately, SolarWinds recommends limiting access to known trusted addresses and blocking requests containing `content-encoding`, since the vulnerable Serv-U service does not require this functionality. 

Administrators should also review logs for repeated crashes, suspicious POST requests, unusual access attempts, and unexpected service restarts. Internet-facing file-transfer systems should be placed behind strict access controls, monitored continuously, and segmented from critical internal systems. A file-transfer server should not be sitting exposed like a public donation box for attackers.

Security takeaway 

This incident is a reminder that denial-of-service vulnerabilities in business-critical infrastructure cannot be dismissed as “less serious” simply because they do not directly provide code execution. If an attacker can reliably crash a file-transfer service, they can still cause operational disruption and potentially mask other activity.

The practical message is simple: patch SolarWinds Serv-U, restrict exposure, monitor for exploitation attempts, and treat managed file-transfer platforms as high-value infrastructure. Attackers have repeatedly targeted file-transfer systems because they sit close to sensitive data and business processes. Leaving them exposed or unpatched is not risk acceptance. It is just optimism with a maintenance window.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity security flaw impacting SolarWinds Serv-U multi-protocol file server software to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability, tracked as CVE-2026-28318 (CVSS score: 7.5), is a denial-of-service (DoS) bug that causes the service to crash

Source: CISA Adds Actively Exploited SolarWinds Serv-U DoS Flaw to KEV Catalog via The Hacker News — published 06 Jun 2026.