CISA warns of active exploitation of SolarWinds ServU flaw

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned that a recently patched vulnerability in SolarWinds ServU file transfer software is now being actively exploited in attacks. The agency added the flaw to its Known Exploited Vulnerabilities catalog on Friday, June 5, 2026, urging all organizations, especially federal agencies, to apply a security update immediately.

The vulnerability, tracked as CVE-2026-28318, is a denial-of-service issue with a CVSS severity score of 7.5. It allows unauthenticated attackers to crash the ServU service by sending a specially crafted HTTP POST request with a "Content-Encoding: deflate" header. This can disrupt file transfer operations and make the service unavailable to legitimate users.

SolarWinds released a fix for the flaw in ServU version 15.5.4 Hotfix 1. The company advises all customers using ServU 15.5.4 to download and install this hotfix. Users of older, unsupported versions—specifically 15.4.2, 15.5, and 15.5.1—are strongly recommended to upgrade to a supported release. While SolarWinds' initial advisory did not confirm active exploitation, CISA's subsequent catalog listing indicates attacks are underway, though...