The US cybersecurity agency CISA on Friday warned of attacks targeting a SolarWinds Serv-U vulnerability that had been patched a couple of days earlier.
Tracked as CVE-2026-28318 (CVSS score of 7.5), the bug is described as a denial-of-service (DoS) issue that can be exploited via specially crafted POST requests to crash the Serv-U service.
Successful exploitation of the security defect does not require authentication, SolarWinds warned on Thursday.
The flaw was addressed in Serv-U 15.5.4 Hotfix 1. SolarWinds encourages all customers to download and install the hotfix, including those who recently upgraded to Serv-U 15.5.4.
According to SolarWinds, the hotfix prevents attackers from crashing the Serv-U service via requests containing the ‘Content-Encoding: deflate’ header and some data.
Users of Serv-U versions 15.4.2, 15.5, and 15.5.1, which have reached End-of-Life (EoL), are advised to upgrade to a supported release as soon as possible.
While SolarWinds’s advisory makes no mention of CVE-2026-28318 being exploited in the wild, CISA on Friday added the bug to its Known Exploited Vulnerabilities (KEV) catalog.
It’s unclear who is behind the attacks and whether the vulnerability has been exploited as a zero-day.
In line with Binding Operational Directive (BOD) 22-01’s requirements, CISA urged federal agencies to patch the CVE by June 19 to keep their networks protected against active threats.
While BOD 22-01 only applies to federal agencies, all organizations are advised to apply SolarWinds’ hotfix as soon as possible.
The company’s advisory contains detailed instructions on installing the hotfix and on removing it if necessary.
Related: Chrome 149 Patches 429 Vulnerabilities
Related: Mirasvit Vulnerability Exploited to Execute Code on Magento Servers
Related: Gitea Vulnerability Exposed 30,000 Deployments to Attacks
Related: Half of the 6 Million Internet-Facing FTP Servers Lack Encryption
