CVE-2026-28318 · SolarWinds Serv-U Unauthenticated Denial of Service via…

01 · The Real Story

A single HTTP header acts as a kill switch for your entire file-transfer service, and attackers are already flipping it

CVE-2026-28318 lets an unauthenticated attacker crash the SolarWinds Serv-U managed file transfer service with a single POST request carrying a Content-Encoding: deflate header. The body doesn't even need to be valid compressed data. Underneath the crash is a logic error: the safety check that should catch the malformed encoding only fires when HTTP compression is *disabled* — but compression is *enabled* by default, so on a stock install the payload is handed straight to the decompressor, which performs an invalid free(), triggers heap corruption, and the allocator aborts the process. Affected versions: Serv-U 15.4.2 (EOL), 15.5 (EOL), 15.5.1 (EOL), and 15.5.4. Fixed in: Serv-U 15.5.4 Hotfix 1 (build 15.5.4.125), released June 3, 2026.

SolarWinds scored this 7.5 HIGH — and that rating is honest. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H is mathematically correct for a network-accessible, zero-click, unauthenticated crash with no confidentiality or integrity impact. CISA agreed by adding CVE-2026-28318 to the KEV catalog on June 5, 2026, one day after disclosure, with a 14-day federal remediation deadline — a short leash that signals real exploitation, not speculative risk. Bishop Fox independently confirmed the DoS is real but explicitly ruled out RCE, documenting three separate dead-end paths toward code execution. The vendor severity matches reality: this is a HIGH-impact DoS with active exploitation, but it is *not* a foothold vulnerability.

"One-packet unauthenticated service kill, actively exploited, but the ceiling is DoS — no path to code execution."

02 · The Attack Path

4 steps from start to impact.

STEP 01

Identify exposed Serv-U instances

The attacker scans for SolarWinds Serv-U HTTP/HTTPS listeners on common ports (80, 443, 8443). Serv-U's default banner and response headers make fingerprinting straightforward. Shodan indexed over 12,000 internet-facing Serv-U instances at disclosure; Shadowserver tracked ~3,100.

Conditions required:

Target Serv-U instance is reachable over the network (internet-facing or attacker has internal network access)

Where this breaks in practice:

Internal-only deployments not reachable from the internet are protected by network segmentation

Detection/coverage: Shodan dork: product:Serv-U. BishopFox released a safe detection script at github.com/BishopFox/CVE-2026-28318-check that sends a benign Content-Encoding: identity probe — patched hosts return 415, vulnerable hosts return 401/404.

STEP 02

Craft malicious POST request

The exploit payload is trivial: a single HTTP POST to any Serv-U endpoint with the header Content-Encoding: deflate and any body content. No valid compression, no authentication token, no session cookie required. At least 7 public PoC repositories exist on GitHub (e.g., jenniferreire26/CVE-2026-28318, SecureWithUmer/CVE-2026-PoCs), and the attack is reproducible with a one-line curl command.

Conditions required:

Attacker can send an HTTP POST to the target (no WAF blocking Content-Encoding headers)

Where this breaks in practice:

A WAF or reverse proxy that strips or rejects Content-Encoding: deflate on POST requests blocks the attack entirely

Detection/coverage: WAF logs will show POST requests with Content-Encoding: deflate to Serv-U endpoints. IDS signatures for this header pattern on MFT ports are trivial to write.

STEP 03

Trigger heap corruption and service crash

The Serv-U HTTP handler receives the deflate-encoded body. Because compression is enabled by default, the safety check is skipped, and the raw bytes are passed to the decompressor. The decompressor calls free() on an invalid pointer, corrupting the heap. The memory allocator detects the corruption and aborts the process. The entire Serv-U service crashes immediately.

Conditions required:

Target is running Serv-U ≤ 15.5.4 (without HF1)
HTTP compression is enabled (default configuration)

Where this breaks in practice:

Organizations that disabled HTTP compression (non-default) accidentally activate the safety check that *would* catch this — but this is an extremely rare configuration

Detection/coverage: The Serv-U process terminating is visible in Windows Event Log (unexpected service stop) or Linux syslog. Process monitoring / SIEM alerting on Serv-U service crashes is straightforward.

STEP 04

Sustain denial of service

If Serv-U is configured with automatic service restart (common in production), the attacker can repeat the single-packet crash on a loop to keep the service permanently offline. Each crash+restart cycle takes seconds. All active file transfers, FTP sessions, and SFTP connections are dropped. Bishop Fox confirmed there is no path from this crash to remote code execution — the attacker's ceiling is sustained DoS.

Conditions required:

Attacker maintains network connectivity to the target

Where this breaks in practice:

Rate limiting or IP blocking after repeated crashes can throttle sustained attacks
If the attacker's source IP is blocked after the first crash, subsequent attempts fail

Detection/coverage: Repeated rapid service restarts within a short window are a high-fidelity detection signal. Monitoring for >2 Serv-U process crashes in 5 minutes is a reliable alert.

03 · Compensating Control

HIGH 7.5→LOW 2.0

SEVERITY REDUCED

Block Content-Encoding headers on Serv-U endpoints at the WAF or reverse proxy — The exploit requires Content-Encoding: deflate in the POST request. Serv-U does not legitimately require client-side content encoding — SolarWinds confirmed this header is unnecessary for normal operation. Configure your WAF (F5, Cloudflare, Akamai, ModSecurity) to strip or reject any request to Serv-U ports that includes a Content-Encoding header. This is a KEV-listed, actively exploited vulnerability — deploy this mitigation immediately, within hours, overriding the standard noisgate mitigation SLA.

HIGH 7.5→LOW 3.0

SEVERITY REDUCED

Restrict Serv-U HTTP/HTTPS access to known partner IPs via network ACLs — If Serv-U must be internet-facing, limit inbound access to known partner, vendor, and internal IP ranges using firewall rules or cloud security groups. This eliminates opportunistic exploitation from arbitrary IPs. Deploy within hours given KEV status. The residual risk is that an attacker compromises or spoofs a trusted partner IP, but this dramatically raises the bar.

HIGH 7.5→MEDIUM 5.0

SEVERITY REDUCED

Enable automatic service restart with crash-rate alerting — Configure Serv-U for automatic restart on process termination (Windows Service Recovery or systemd Restart=always), and set a SIEM alert on >2 restarts within 5 minutes. This does not prevent the crash but limits the blast radius of a single-shot DoS to seconds of downtime. This is a detection and resilience control, not a prevention control — it reduces impact severity but does not eliminate the vulnerability.

HIGH 7.5→IGNORE 0.0

SEVERITY REDUCED

Apply Serv-U 15.5.4 Hotfix 1 (build 15.5.4.125) — The definitive fix. The hotfix modifies Serv-U to reject any request with a body and a non-empty Content-Encoding header, returning HTTP 415 before the decompressor is reached. Given KEV listing and active exploitation, this overrides the standard noisgate remediation SLA — patch immediately, within hours. Test in staging first if possible, but do not delay past 24 hours for internet-facing instances.

What doesn't work

Disabling HTTP compression in Serv-U settings — Counterintuitively, this *enables* the safety check that would catch the malformed encoding, but it also breaks legitimate compressed transfers and is not a supported mitigation. SolarWinds does not recommend this as a workaround, and the behavior may change in future updates.
IDS/IPS signature for deflate payloads — While you can alert on Content-Encoding: deflate, passive IDS cannot block the request in time. The crash occurs on the first packet. You need an inline WAF or reverse proxy, not a tap-mode sensor.
Network-level rate limiting — The crash is triggered by a single request, not a flood. Rate limiting will not prevent the first crash; it only slows sustained re-crashing after the service restarts.

04 · Intelligence Metadata

The supporting signals.

In-the-Wild Exploitation	Confirmed. CISA added CVE-2026-28318 to the KEV catalog on June 5, 2026 — one day after public disclosure — citing evidence of active exploitation. No specific threat actor attribution, but Serv-U has been historically targeted by Cl0p ransomware gang and Chinese APT DEV-0322.
CISA KEV Status	Listed. Added June 5, 2026. Federal remediation deadline: June 19, 2026 (14-day BOD 22-01 window). CISA alert
PoC Availability	Public. 7 GitHub repositories with exploit code (e.g., jenniferreire26/CVE-2026-28318, SecureWithUmer/CVE-2026-PoCs). Bishop Fox released a safe detection tool (not a crash trigger) at BishopFox/CVE-2026-28318-check. Exploit is trivially reproducible with `curl`.
EPSS	5.32% probability of exploitation in the next 30 days — elevated for a DoS-only vulnerability, reflecting the trivial exploit complexity and active exploitation.
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` — 7.5 HIGH. Network-accessible, no auth, no user interaction, availability-only impact. The vector is accurate; there is no confidentiality or integrity impact.
Affected Versions	Serv-U 15.4.2 (EOL), 15.5 (EOL), 15.5.1 (EOL), 15.5.4 (current release without hotfix). All versions prior to build 15.5.4.125 are vulnerable.
Fixed Version	Serv-U 15.5.4 Hotfix 1 (build 15.5.4.125), released June 3, 2026. The fix rejects any request with a body and a non-empty `Content-Encoding` header, returning HTTP 415 Unsupported Media Type.
Internet Exposure	Shodan: ~12,000 exposed Serv-U instances at disclosure (declining to ~10,000 by end of June 2026). Shadowserver: ~3,100 instances. Significant attack surface for an unauthenticated single-request DoS.
Disclosure Date	June 4, 2026 (public advisory). Patch released June 3, 2026. CISA KEV added June 5, 2026.
RCE Feasibility	Ruled out. Bishop Fox pursued three separate paths to code execution from the heap corruption and confirmed all are dead ends. This is a DoS-only vulnerability.

Sources.

05 · The Call

Final Verdict

= UNCHANGED to HIGH (7.5/10)

Why this verdict

Vendor baseline is accurate: The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H = 7.5 is mathematically correct for a zero-click, unauthenticated, network-accessible service crash with availability-only impact. No adjustment needed to the base score.
Zero friction in the attack chain: The exploit requires one HTTP request with a single crafted header. No authentication, no user interaction, no multi-step chaining, no special tooling. Seven public PoCs exist. The exploit is literally a curl one-liner. There is zero friction to depress the score.
Active exploitation validates the rating: CISA added this to KEV within 24 hours of disclosure, confirming in-the-wild exploitation. Serv-U has a documented history of targeting by Cl0p and APT DEV-0322. The 12,000+ internet-facing instances provide a large attack surface. These factors reinforce HIGH, not reduce it.
Impact ceiling caps at DoS: Bishop Fox exhaustively proved there is no path from heap corruption to code execution — three separate RCE approaches all failed. The attacker's maximum outcome is a sustained service crash. There is no confidentiality or integrity impact, no lateral movement, no data exfiltration.
Role multiplier: Serv-U is a managed file transfer (MFT) server. (a) *Low-value role:* dev/test file sharing — DoS impact is negligible. (b) *Typical role:* business file transfer for partner exchange — DoS disrupts operations but is recoverable. (c) *High-value role:* production MFT handling regulated data transfers (HIPAA HL7 feeds, PCI batch files, supply-chain EDI). Even in this role, the outcome is service unavailability — not domain takeover, not fleet compromise, not data exfiltration, not supply-chain code injection. The blast radius is host-level (single service crash), not identity-scale or fleet-scale. The high-value role floor criteria (domain takeover / fleet compromise / mass data egress / supply-chain pivot) are not met because the vulnerability is DoS-only. No floor adjustment required.

Why not higher?

CRITICAL requires either (a) code execution / full system compromise or (b) a DoS so catastrophic it constitutes a safety or fleet-wide cascading failure. This is a single-service crash on a file-transfer appliance. The heap corruption is real but not exploitable for RCE — Bishop Fox documented three dead-end paths. Crashing one Serv-U process does not cascade to other hosts, does not grant persistence, and does not compromise identity infrastructure. The impact ceiling is firmly A:H with no C or I component.

Why not lower?

Downgrading below HIGH would require either meaningful friction in the attack path or limited real-world exposure. Neither applies. The exploit is a single unauthenticated HTTP request, 12,000+ instances are internet-facing, active exploitation is confirmed by CISA KEV, and 7 public PoCs exist. The attack surface is real, the weaponization is trivial, and the exploitation is happening now. MEDIUM would be indefensible.

06 · Verification

Crowdsourced verification payload.

Run this script from any workstation with network access to the target Serv-U instance. No special privileges required. Invoke with: python3 check_cve_2026_28318.py <host> [port]. Defaults to HTTPS on port 443. The script sends a safe Content-Encoding: identity probe (never deflate) — it will NOT crash the target.

noisgate-verify.py

PYTHONREAD-ONLYSAFE

#!/usr/bin/env python3
"""CVE-2026-28318 safe detection script.
Sends Content-Encoding: identity (harmless) and checks response.
Patched Serv-U returns 415; vulnerable returns 401/404/200.
Exit 1 = VULNERABLE, Exit 0 = PATCHED/NOT-SERV-U, Exit 2 = UNKNOWN.
"""
import sys
import ssl
import http.client

def check(host, port=443):
    try:
        ctx = ssl.create_default_context()
        ctx.check_hostname = False
        ctx.verify_mode = ssl.CERT_NONE
        conn = http.client.HTTPSConnection(host, port, timeout=10, context=ctx)
        headers = {
            "Content-Encoding": "identity",
            "Content-Type": "application/octet-stream",
            "User-Agent": "noisgate-CVE-2026-28318-check/1.0"
        }
        conn.request("POST", "/", body=b"noisgate-safe-probe", headers=headers)
        resp = conn.getresponse()
        server = resp.getheader("Server", "")
        if "Serv-U" not in server and "serv-u" not in server.lower():
            print(f"NOT-SERV-U  {host}:{port}  Server: {server}")
            return 0
        if resp.status == 415:
            print(f"PATCHED     {host}:{port}  HTTP {resp.status} (HF1 applied)")
            return 0
        elif resp.status in (200, 401, 403, 404):
            print(f"VULNERABLE  {host}:{port}  HTTP {resp.status} (missing HF1)")
            return 1
        else:
            print(f"UNKNOWN     {host}:{port}  HTTP {resp.status}")
            return 2
    except Exception as e:
        print(f"ERROR       {host}:{port}  {e}")
        return 2

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} <host> [port]")
        sys.exit(2)
    host = sys.argv[1]
    port = int(sys.argv[2]) if len(sys.argv) > 2 else 443
    sys.exit(check(host, port))