Exploitation observed; activity peaked at 22 mentions and remains active
Recommended action window: Immediate (within 24h)
NVD description
SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate. Mitigation steps are provided to secure customer environments in the SolarWinds Trust Center if you are unable to deploy the update
Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-06-19. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Priority
CRITICAL
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
DECLINING
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
| Date | Total | Labels |
|---|
| 2026-06-04 | 1 | Disclosure1 |
| 2026-06-05 | 6 | Active Exploitation5Patch1 |
| 2026-06-06 | 13 | Active Exploitation11Disclosure1General1 |
| 2026-06-07 | 12 | Active Exploitation10General1Patch1 |
| 2026-06-08 | 22 | Active Exploitation19Disclosure1General1Patch1 |
| 2026-06-09 | 4 | Active Exploitation2Disclosure1Patch1 |
| 2026-06-10 | 5 | Active Exploitation4General1 |
| 2026-06-11 | 1 | Active Exploitation1 |
| 2026-06-12 | 1 | Active Exploitation1 |
| 2026-06-13 | 1 | General1 |
| 2026-06-17 | 1 | Active Exploitation1 |
| 2026-06-18 | 4 | Active Exploitation2Disclosure2 |
| 2026-06-21 | 1 | Active Exploitation1 |
| 2026-06-24 | 1 | Active Exploitation1 |
| 2026-06-28 | 1 | General1 |
🛡️ We added SolarWinds Serv-U uncontrolled resource consumption vulnerability CVE-2026-28318 to our KEV Catalog. Visit https://go.dhs.gov/Z3Q & apply mitigations to protect your org from cyberattacks. #Cybersecurity #InfoSec https://t.co/9hYg4WtLZq
Post summary
The tweet announces the addition of CVE-2026-28318 to the KEV catalog and urges users to implement mitigations to protect against potential attacks.
🚨 A SolarWinds Serv-U bug is now on CISA’s exploited list. CVE-2026-28318 can let unauthenticated requests crash the file server. Patch: Serv-U 15.5.4 HF1. Federal agencies have until June 19, 2026. Read: https://thehackernews.com/2026/06/cisa-adds-actively-exploited-solarwinds.html
Post summary
CISA has added CVE-2026-28318 to its actively exploited list, confirming real-world attacks, and a patch (Serv-U 15.5.4 HF1) is available.
AIが攻撃側を一段加速させ、KEV登録の重大脆弱性は3件、国内インシデントは4件連発の朝だ。順に斬っていく。 ・CVE-2026-28318、SolarWinds Serv-UのDoSがKEV入り ・GoogleがAI脆弱性発見時代の15の防御策を公開 ・Anthropic、AI脅威加速を警告し7つの優先対策 ・富山の老舗飲料メーカー、ランサム被害で会計暗号化 ・Everest Forms ProのCVE-2026-3300、WP完全乗っ取り ・中国系UNC5221、M365に新マルウェアPlanet/AgentPSD ・エン・ジャパン「ミドルの転職」、リスト型で会員不正アクセス ・アソビュー予約管理に攻撃、約1.4万件の個人情報漏えい ・東京デジタルアカデミー、設定不備でCSV不正DL確認 ・WishList MemberのCVE-2026-6419、不審アカウント作成の恐れ 君の現場、KEV登録の3件は今夜中に当てられるか？WordPress、M365、ファイル転送、棚卸しは48時間以内に終わるか？
Post summary
The text reports several critical vulnerabilities, including KEV‑registered DoS and full takeover of WordPress, and indicates active exploitation but offers no patches, PoC, or exploit code.
‼️ CISA has added CVE-2026-28318 to the KEV Catalog https://darkwebinformer.com/cisa-kev-catalog/ SolarWinds Serv-U contains an uncontrolled resource consumption vulnerability that allows specially crafted POST requests using the Content-Encoding: deflate header to crash the Serv-U service without authentication. Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Post summary
CVE-2026-28318 is a resource‑consumption flaw in SolarWinds Serv‑U listed in CISA’s KEV catalog, indicating active exploitation. No PoC or exploit code is provided, but vendor mitigations are recommended.
Your CMDB says 847 assets. Shodan says...lots more. That gap is your attack surface — the one attackers probe. CISA just KEV'd CVE-2026-28318 in SolarWinds Serv-U. 12,000+ exposed instances. Inventory ≠ attack surface. The delta between the two is where breaches start. #AttackSurfaceManagement #VulnerabilityManagement https://na2.hubs.ly/H05_Rww0
Post summary
The tweet highlights a CISA KEV for SolarWinds Serv-U CVE‑2026‑28318 with 12,000+ exposed instances, emphasizing the gap between an organization’s CMDB and the broader attack surface discovered via Shodan.
米国CISAが悪用を確認した脆弱性 #KEV をカタログに追加しました。（6/5追加） 🛡No.1613 CVE-2026-28318 SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability =================================== ✅概要 ・深刻度：重要 7.5 (CVSS Base) / SolarWinds (CNA) ・種別：リソースの枯渇 (CWE-400) ・CVSS:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H SolarWinds Serv-U に制御されていないリソース消費の脆弱性が存在します。 事前認証されていない攻撃者が Content-Encoding: deflate を含む細工した POST リクエストを送信することで、Serv-U サービスをクラッシュさせる恐れがあります。 ✅ChatGPTによる脆弱性評価 ・国内影響度：中 ・悪用難易度：低 ✅攻撃前提条件 ・SolarWinds Serv-U 15.5.4 およびそれ以前を使用している ・外部から Serv-U に対して HTTP POST リクエストを送信できる ・Content-Encoding: deflate を含む細工した POST リクエストが処理される ・SolarWinds Serv-U 15.5.4 HF1 が適用されていない ✅悪用時影響 ・Serv-U サービスがクラッシュする ・サービス拒否状態が発生する ・ファイル転送サービスの可用性が損なわれる ✅悪用事例等に関する公開情報 ・PoC/Exploit：一部公開（技術情報のみ） ・ITW：未確認 ✅関連情報 ・https://nvd.nist.gov/vuln/detail/CVE-2026-28318 ・https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28318 ・https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-5-4-hotfix-1_release_notes.htm https://www.cisa.gov/news-events/alerts/2026/06/05/cisa-adds-one-known-exploited-vulnerability-catalog #vulnerability
Post summary
CISA confirms CVE-2026-28318 is actively exploited in the wild, with partial PoC details available and a patch/hotfix recommended.
Discover the active SolarWinds Serv-U bug (CVE-2026-28318). Learn how the unauthenticated crash flaw impacts servers and how to apply the patch. #SolarWinds #ServU #Cybersecurity #InfoSec #CISA #CVE202628318 #ThreatIntel https://meterpreter.org/solarwinds-serv-u-bug/ https://t.co/MfUOBhatF2
Post summary
The tweet announces the SolarWinds Serv-U CVE-2026-28318 vulnerability—an unauthenticated crash flaw—and emphasizes applying the patch to mitigate the issue.
CISA just added SolarWinds Serv-U CVE-2026-28318 to the KEV catalog: an unauthenticated request can crash the server, and it is being exploited in the wild now. CVSS 7.5. if you run Serv-U for managed file transfer, patching is the move. breakdown: https://purple-ops.io/blog/solarwinds-serv-u-cve-2026-28318 https://t.co/5jjFkqDm0K
Post summary
CISA has listed CVE‑2026‑28318 in its KEV catalog, noting that unauthenticated requests are causing server crashes and are currently being exploited in the wild, and urges users to patch immediately.
📌 ثغرة CVE-2026-28318 في SolarWinds Serv-U تسمح بشن هجوم DoS وأضيفت إلى قائمة KEV التابعة لـ CISA تم اكتشاف ثغرة أمنية في SolarWinds Serv-U تسمح بتنفيذ هجوم (DoS). تمت إضافة هذه الثغرة إلى قائمة KEV التابعة لـ CISA، مما يشير إلى ارتفاع مستوى الخطورة. يُصنف مؤشر CVSS لهذه الثغرة بـ 7.5، مما يعتبره مستوى عاليًا. تم تحديد موعد نهائي للتخلص من هذه الثغرة في 19 يونيو 2026. 🔗 للمزيد: https://thecyberthrone.in/2026/06/08/cve-2026-28318-solarwinds-serv-u-dos-added-to-cisa-kev/
Post summary
SolarWinds Serv‑U has a DoS vulnerability (CVE‑2026‑28318) with CVSS 7.5, added to CISA KEV; remediation is advised by 19 June 2026.
CISA has added CVE-2026-28318 to its Known Exploited Vulnerabilities catalog after confirmed active exploitation against SolarWinds Serv-U. The vulnerability impacts the Serv-U web interface and can be triggered remotely by unauthenticated attackers, resulting in a denial of service condition. While this is not currently described as a remote code execution issue, disruption to file transfer infrastructure can still create significant operational and security risk, especially in environments where Serv-U supports sensitive file movement, third-party access, or regulated data workflows. Organizations running SolarWinds Serv-U should validate affected versions, apply the vendor hotfix, and review exposure of the Serv-U web interface. Additional defensive steps should include restricting access to trusted IP addresses, monitoring for anomalous POST requests, reviewing web and application logs, and confirming that compensating controls are in place where immediate patching is not possible. This is also a reminder that externally exposed administrative and file transfer services should be continuously inventoried, vulnerability scanned, and prioritized based on exploitability, exposure, and business criticality. #Cybersecurity #CISA #SolarWinds #ServU #CVE202628318 #VulnerabilityManagement #PatchManagement #ThreatDetection #AttackSurfaceManagement #DenialOfService
Post summary
CISA confirmed that CVE‑2026‑28318 is actively exploited in the wild against SolarWinds Serv‑U, causing a denial‑of‑service via unauthenticated remote triggers. A vendor hotfix is available and organizations should patch or apply advised mitigations.
CVE-2026-28318 | SolarWinds Serv-U Pre-Auth DoS One HTTP POST with Content-Encoding: deflate crashes the service. ~260KB expands to 256MB, SIGABRT. CISA KEV (active exploitation). CVSS 4.0: 9.2. Analysis + PoC: https://aretiq.ai/research/11/
Post summary
CVE-2026-28318 is a pre-authentication DoS in SolarWinds Serv-U that triggers a crash via a deflate-encoded POST request; a PoC is publicly shared, and the vulnerability is actively exploited in the wild.
CISA has warned that attackers are actively exploiting SolarWinds Serv-U (CVE-2026-28318), allowing unauthenticated attackers to crash vulnerable servers through crafted requests. If Serv-U is exposed externally, prioritize patching and monitor for abnormal POST requests.
Post summary
CISA confirms active exploitation of CVE‑2026‑28318 against SolarWinds Serv‑U, impacting uncategorized unauthenticated attackers with server crash via crafted POST requests, and urges urgent patching and monitoring.
SolarWinds Serv-U (CISA KEV) CISA added SolarWinds Serv-U (CVE-2026-28318) to the KEV catalog active exploitation confirmed. The high-severity resource consumption flaw lets unauthenticated attackers crash servers remotely. Federal agencies have a binding patch deadline. Source: BleepingComputer / CISA Full analysis → http://t.me/VulnerabilityNews Follow @VulnerabilityNw
Post summary
CISA confirms active exploitation of SolarWinds Serv‑U CVE‑2026‑28318, a high‑severity resource‑consumption flaw allowing unauthenticated attackers to crash servers remotely, with a binding patch deadline for federal agencies.
A Crash, Not a Shell: SolarWinds Serv-U CVE-2026-28318 https://bishopfox.com/blog/a-crash-not-a-shell-solarwinds-serv-u-cve-2026-28318
Post summary
The post reviews the newly disclosed SolarWinds Serv-U CVE-2026-28318, outlining its crash‑inducing behavior and providing technical details along with reference to available vendor remediation.
【サイバーセキュリティ動向分析】 トレンドのセキュリティニュース（2026年6月時点） 主なトピック： Chrome 149で過去最多429件の脆弱性を修正（クリティカル22件含む） Cisco Catalyst SD-WAN Managerのゼロデイ脆弱性（CVE-2026-20245）が積極的に悪用中（パッチ未提供） SolarWinds Serv-UのDoS脆弱性（CVE-2026-28318）がCISA KEVに追加され悪用確認 AI関連脅威の急増（AIエージェントによるゼロデイ発見、プロンプトインジェクション、Shadow AIなど） npm/GitHubリポジトリへのサプライチェーン攻撃（Miasma Wormなど） データ侵害事例（DentaQuestなど） 関連リンク（https://から始まるURLそのまま記載）： https://thehackernews.com/ https://www.securityweek.com/chrome-149-patches-429-vulnerabilities/ https://www.securityweek.com/cisco-warns-of-7th-sd-wan-zero-day-exploited-in-2026/ https://www.bleepingcomputer.com/news/security/cisa-hackers-now-exploit-solarwinds-serv-u-flaw-to-crash-servers/ https://www.security-next.com/185464 https://www.security-next.com/185441 https://thehackernews.com/2026/06/cisa-adds-actively-exploited-solarwinds-serv-u-dos-flaw-to-kev-catalog.html https://www.darkreading.com/ https://www.cybersecuritydive.com/ https://www.trendmicro.com/ja_jp/security-intelligence/breaking-news.html https://cyberscoop.com/ これらは直近のヘッドライン中心です。詳細は各サイトで最新を確認してください。
Post summary
The post summarizes recent security news for June 2026, noting active exploitation of a Cisco zero‑day (CVE‑2026‑20245) and a SolarWinds Serv‑U DoS flaw (CVE‑2026‑28318) added to CISA KEV, alongside Chrome patching and other threat headlines.
CVE-2026-28318 in SolarWinds Serv-U allows unauthenticated heap corruption via a single request, crashing the service. Bishop Fox confirmed no reliable RCE path, but a DoS against a managed file-transfer server is serious. #DFIR_Radar https://t.co/uQ37P47oNs
Post summary
The post announces that CVE‑2026‑28318 in SolarWinds Serv‑U triggers unauthenticated heap corruption, resulting in a denial‑of‑service, with Bishop Fox confirming no reliable RCE path.
CISA KEV 警告 26/06/05：SolarWinds Serv-U の脆弱性 CVE-2026-28318 を追加 https://iototsecnews.jp/2026/06/06/cisa-alerts-on-actively-exploited-solarwinds-serv-u-denial-of-service-flaw/ 脆弱性 CVE-2026-28318 は、システムがデータを受け取った際に、割り当てるリソースの量をコントロールできなくなってしまうことが原因で発生します。具体的には、特定のヘッダーを含んだリクエストを処理する仕組みの内部に問題があり、CPU やメモリを過剰に使い切ってしまうためにサービスが停止してしまいます。認証情報を持たない外部の相手からでも、ネットワーク経由でリソースが枯渇させられてしまう点が特徴です。ご利用のチームは、ご注意ください。 #CISA #CVE202628318 #Exploit #KEV #ServU #SolarWinds #Vulnerability
Post summary
CISA issues a KEV alert that CVE‑2026‑28318 is being actively exploited in the wild, causing a denial‑of‑service via resource exhaustion.
Top #CVE to prioritize 👀 - @Android Framework #privesc (CVE-2025-48595) - @SolarWinds Serv-U (CVE-2026-28318) - @Cisco Catalyst SD-WAN Manager (CVE-2026-20245) - @Cisco Unified Communications Manager (CVE-2026-20230) - @Acer Wave 7 routers (CVE-2026-49200/49201) - @UniFi OS Server (CVE-2026-34908/34909) - @Google Chrome (CVE-2026-10881/10882/10883) - #MCP Toolbox (CVE-2026-9739) - @Ivanti ISTM (CVE-2026-9614) - @Atlassian Bamboo Data Center #RCE (CVE-2026-27727)
Post summary
Tweet lists several high-profile CVEs to prioritize, offering minimal context (e.g., privilege escalation for Android, RCE for Atlassian) but no PoC, exploit, or patch details.
CVE-2026-28318. Status: ✅ Confirmed exploited in the wild Date added: 2026-06-05 Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Post summary
CVE-2026-28318 is confirmed to be exploited in the wild, and vendors are urged to apply mitigations or discontinue use if no patch is available.
Fresh patch warning: browsers and AI gateways are both in the firing line. Google just patched Chrome CVE-2026-11645, an actively exploited V8 zero-day. SecurityWeek says it is the 5th Chrome zero-day exploited in 2026. A crafted HTML page could let an attacker run code inside the sandbox, and real attacks may have chained it with a sandbox escape. At the same time, CISA added BerriAI LiteLLM CVE-2026-42271 to KEV after active exploitation. The flaw is command injection, and researchers showed it can be chained with a Starlette host-header bypass into unauthenticated RCE on vulnerable deployments. Also on the patch list: SolarWinds Serv-U CVE-2026-28318, exploited in the wild to crash exposed services. Simple rule today: Update Chrome. Patch LiteLLM. Patch Serv-U. Then check logs, not just versions. Exploitation is moving faster than maintenance windows.
Post summary
Three high‑profile CVEs—Chrome V8, BerriAI LiteLLM, and SolarWinds Serv‑U—are actively exploited, prompting urgent patches and mitigation steps.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | solarwinds | serv-u | - | - | - |
| App | solarwinds | serv-u | 15.5.4 | - | - |