CVE-2026-28318: Serv-U crashed by unauthenticated deflate POST requests

What it is

Serv-U, SolarWinds’ managed file transfer server, can be crashed by anyone who can reach it. A POST request with the header Content-Encoding: deflate, built in a specific way, makes the Serv-U service fail. No login is needed. The bug is rated 7.5 (high, CVSS 3.1) and is classed as uncontrolled resource consumption.

The impact is denial of service only. The advisory describes a service crash, not code execution or data access. For a file transfer server that partners and automated jobs depend on, an outage can still hurt.

CISA added the CVE to its KEV catalog on June 5, 2026, the day after the hotfix shipped. That means CISA has evidence of exploitation. Neither CISA nor SolarWinds says who is exploiting it or how, and the SolarWinds advisory makes no exploitation statement of its own.

Am I affected?

You are affected if you run Serv-U 15.5.4 or any earlier version, on Windows or Linux, and the web service can be reached by an attacker. Serv-U 15.5.4 without Hotfix 1 is still vulnerable.

The hotfix only installs on Serv-U 15.5.4. Older versions must first move to 15.5.4.

SolarWinds lists no other configuration condition. Treat any internet-facing Serv-U as exposed.

What to do

1. Install Serv-U 15.5.4 Hotfix 1. SolarWinds’ steps are file replacement, not an installer:
   1. Stop Serv-U from the tray icon (Stop Serv-U, then Exit Tray).
   2. Back up the files you will replace. On Windows: Serv-U.exe, Serv-U-Tray.exe, Serv-U.dll, Serv-U-RES.dll, RhinoNET.dll, RhinoRES.dll, Strings\Serv-U.str, Strings\Serv-U-Strings.h. On Linux: Serv-U, Strings/Serv-U.str, Strings/Serv-U-Strings.h.
   3. Extract the hotfix archive and open the folder for your platform.
   4. Linux only: run chmod u+xs Serv-U on the new binary.
   5. Copy the folder contents into the install directory (default C:\Program Files\RhinoSoft\Serv-U on Windows, /usr/local/Serv-U on Linux).
   6. Start the Serv-U tray application and choose Start Serv-U.
2. If you can’t patch tonight, apply the vendor workarounds:
   • Limit access to the Serv-U web interface to known addresses. Production impact: users and partners outside the list lose access.
   • Block POST requests that contain a content-encoding header at a reverse proxy or WAF. SolarWinds says Serv-U doesn’t need that functionality. The advisory has example rules for many platforms, but SolarWinds says to confirm them with your WAF vendor before use.
3. To roll back, stop Serv-U, restore the backed-up files and start it again.
4. Review availability history. Because exploitation is only a crash, there is no known data theft or persistence from this CVE. Still, check that the service did not crash repeatedly and that nothing else was going on at those times.

Detection

The sources publish no indicators, so detection comes down to the trigger and its effect:

• POST requests with a Content-Encoding header, especially deflate, in reverse proxy, WAF or load balancer logs in front of Serv-U. Serv-U doesn’t need this, so any hit is worth a look.
• Unexpected Serv-U service stops or restarts, particularly ones that follow such a request or come from an address you don’t know.
• Repeated crashes of the Serv-U process from external sources in the days since June 4, 2026.