Security Alert: DoS in Serv-U exposes thousands of systems and requires immediate patch

SolarWinds published an emergency patch for Serv-U after a service denial failure that allows a remote and unauthenticated attacker to cause the service to be blocked by specially built POST requests that they use Content-Encoding: deflate. The update 15.5.4 Hotfix 1 corrects the problem identified as CVE-2026-28318; however, the mere availability of the patch does not guarantee that the environments are protected, because there are already active holdings in nature, according to the U.S. agency CISA.

That CISA has added this vulnerability to Known Exploited Vulnerabilities Catalog it requires the federal agencies to remedy it urgently (the deadline set by the BOD 22-01 directive), and it also provides a clear signal for the private sector: attacks are soon to arrive and the risk is real. You can check the official entry of CISA on this entry in your catalog Here. and the agency's information note Here..

The scope is relevant: Internet device search platforms show thousands of publicly accessible Serv-U instances, making life easier for the attacker who seeks exposed goals. Tools such as Shodan allow estimating the external exposure of Serv-U and Shadowserver maintain attack surface size metrics; both resources are useful for prioritizing mediation work and for verifying the public exposure status of your organization ( Shodan, Shadowserver).

In addition to the direct impact of denial of service, Serv-U has a worrying record: previous vulnerabilities in this product were used by ransomware bands and state actors to penetrate networks and extract information. That turns any incidence into a potential gateway for later lateral operating techniques. Therefore, a DoS is not the worst of the scenarios: it is often the first symptom of a wider chain of attack.

If you administer Serv-U, the immediate recommendation is clear and urgent: apply the Hotfix 15.5.4 Hotfix 1 SolarWinds as soon as possible and supports the application in test environments before deploying in production. SolarWinds' own note with the patch instructions is available at your official documentation center Here..

When it is not possible to park immediately, implement compensatory mitigation: restrict access to IP service to known and trusted addresses, block at perimeter and WAF level any POST method including headers Content-Encoding(functionality is not necessary for vulnerable service) and add rules to IDS / IPS to detect and block unusual deflate patterns. These measures reduce the attack surface but do not replace the patch.

For detection and response, set up alerts in your IMS to identify peaks of POST requests addressed to Serv-U, restart or service failures and persistent 5xx errors on the affected servers. File and analyse suspicious HTTP headers and traffic flows with Anomal Content-Encoding; if you identify active exploitation, isolate the instance, preserve evidence and follow your incident response procedure before restoring service.

Do not forget to do an internal sweep to locate forgotten or poorly configured Serv-U facilities: many gaps come from instances that are not part of the IT inventory. Use authorized asset management and scanning tools to identify vulnerable versions and prioritize those exposed to the Internet or connected to critical networks.

The management of vulnerabilities should combine speed and traceability: prioritize according to exposure and criticality, document changes and tests, and inform the security team and management of the state of mediation. If you operate at the federal level or provide services to agencies, take into account the requirements of the BOD 22-01 and ensure compliance within the prescribed time limits.

On the strategic level, this incident recalls that file transfer products are a critical part of the infrastructure that deserves solid security controls: network segmentation, robust authentication, rigorous parking and continuous monitoring. The best defense remains the combination of updated inventory, fast parking and proactive network mitigation; acting with this triad significantly reduces the likelihood of interruptions or, worse, intrusions with greater impact.