High severity alert in SolarWinds Serv U with active operation and DoS risk

The U.S. federal agency CISA has included in its catalogue of Known Exploited Vulnerabilities (KEV) a high-severity failure affecting SolarWinds Serv-U, the multi-protocol file transfer server, after evidence of active exploitation. This is a vulnerability of uncontrolled resource consumption that can cause service to fall under certain specifically formed HTTP requests, resulting in a denial of service (DoS) condition.

The failure, recorded as CVE-2026-28318 and rated with a CVSS score of 7.5, allows POST requests with Content make the process of Serv-U collapse without authentication. SolarWinds solved the problem in the version 15.5.4 HF1 but the inclusion in the KEV list indicates that there is real malicious activity, so the mitigation priority should be high for Serv-U operators.

This incident should not be read in isolation: Serv-U has been a recurring target in previous campaigns and has been used by groups of ransomware and other criminal actors, making any new vector a relevant operational risk for organizations with regular file exchange flows. The existence of exploitation in the real world implies that even a "single" impact of DoS can become a lever for extortion, diversion of major incidents or business interruption.

The immediate actions recommended for safety are clear: prioritize the installation of the official patch (update to Serv-U 15.5.4 HF1) and, if it is not possible to apply the update immediately, implement perimeter mitigation. Limit access to service by access control lists, block at proxy level or WAF requests including headers Content when the service does not require them, and apply rate / connection limit rules to reduce the risk of resource consumption.

Before applying broad header blocks, organizations should validate that there are no legitimate customers that depend on that channel; an indiscriminate block in proxies or balers may interrupt valid integrations. As a temporary alternative, activate rules in IPS / WAF to detect and deny only observed malicious patterns, and bring critical service behind a swimmer with timeouts policies and concurrence limits.

From the perspective of detection and response, it is important to implement monitoring: to search the unusual POST server and network records with Content-Encoding: deflate, spikes of Serv-U processes that consume CPU / memory, restart of service and patterns of anomalous requests from external origins. If an intrusion or commitment is confirmed, isolate the affected instance, preserve records and follow incident response procedures to investigate scope and possible exfiltrations.

For managers who manage multiple instances, make an urgent inventory of Internet-exposed Serv-U servers and evaluate their version is critical; external scanning tools can detect accessible servers, but they must be used with internal authorization to not violate policies. The federal authorities have set a period of mediation for civil agencies until 19 June 2026, which underlines the need for rapid action in government and private environments.

The operational lesson remains the same: to maintain an effective parking cycle, to reduce unnecessary exposure to Internet services, and to combine patches with perimeter mitigation and traffic visibility. For official documentation and follow-up, see the CISA page on exploited vulnerabilities Known Exploited Vulnerabilities (KEV) and SolarWinds product information about Serv-U SolarWinds Serv-U. For technical details and registration of the CVE, the NIST / NVD maintains public data sheets for vulnerability CVE-2026-28318.