The Attack Did Not Steal Files. It Kept Serv-U From Serving Them.
Attackers were exploiting a SolarWinds Serv-U vulnerability that did not need credentials, a user click or a complex exploit chain. One specially encoded HTTP request could crash the file-transfer service.
CISA added CVE-2026-28318 to its Known Exploited Vulnerabilities catalogue on 5 June 2026. SolarWinds rates the flaw high severity at 7.5. Serv-U 15.5.4 and earlier are affected, and the fix is Serv-U 15.5.4 Hotfix 1.
The vulnerability is an uncontrolled resource-consumption weakness. A remote attacker can send a crafted POST request using Content-Encoding: deflate and force the Serv-U service to stop. SolarWinds says no authentication is required.
Denial of service is the intended effect
CVE-2026-28318 is not described as remote code execution, file theft or an authentication bypass. The published impact is availability: the vulnerable service crashes.
That narrower boundary matters for accurate incident response. CISA’s exploitation finding confirms that the flaw has been used in the wild, but it does not by itself prove that attackers obtained Serv-U credentials or accessed transferred files. Organisations should investigate those possibilities when other evidence exists, not assume them from this CVE alone.
The operational impact can still be serious. Serv-U is used for FTP, SFTP and managed file-transfer workflows. Repeated crashes can interrupt partner exchanges, batch processing, backups, payment files, logistics feeds and other automated processes that assume the server will remain available.
Internet exposure makes a small request a large problem
File-transfer services are frequently reachable by customers, suppliers and remote workers. That exposure is part of the product’s purpose, but it also gives an unauthenticated attacker a direct path to the vulnerable listener.
The attack is automatable and cheap to repeat. A service restart may restore availability without removing the condition that caused it. If the vulnerable endpoint remains reachable, the attacker can trigger another crash and turn a single request into sustained disruption.
CISA gave US federal civilian agencies until 19 June 2026 to remediate. Other organisations are not bound by that deadline, but confirmed exploitation and low attack complexity make the same prioritisation sensible.
Patch, then confirm the workflows recovered
- Upgrade Serv-U to 15.5.4 Hotfix 1 or a later fixed release.
- If immediate patching is impossible, apply SolarWinds’ documented mitigation and restrict access to trusted source addresses where the business process allows it.
- Monitor for repeated POST requests carrying the
Content-Encoding: deflateheader and correlate them with Serv-U crashes or restarts. - Check service logs, operating-system events and monitoring data for unexplained outages before the patch was installed.
- Verify that scheduled transfers, downstream imports, backups and partner workflows completed after recovery.
- Do not treat an automatically restarted process as a completed incident. Confirm the fixed version and remove temporary exposure.
The lesson is that availability vulnerabilities deserve business-process context. A CVSS score cannot show which payroll, healthcare, manufacturing or supply-chain workflow depends on the affected transfer server. For an exposed Serv-U instance carrying time-sensitive exchanges, one small unauthenticated request can become a much larger operational incident.
Sources: SolarWinds security advisory (published 4 June 2026; no publication time provided), SolarWinds Serv-U 15.5.4 Hotfix 1 release notes (published in June 2026; no precise publication time provided), CISA Known Exploited Vulnerabilities catalogue (added 5 June 2026 at 15:00 UTC in the NVD change record), and Canadian Centre for Cyber Security advisory AV26-549 (published 4 June and updated 5 June 2026; no publication times provided).
