Threat reportVulnerabilityTL-2026-0717
SolarWinds Serv-U DoS (CVE-2026-28318) — Actively Exploited Uncontrolled Resource Consumption via Content-Encoding: deflate POST
SolarWinds Serv-U DoS (CVE-2026-28318) (TL-2026-0717), also tracked as Serv-U deflate-bomb DoS, is a high-severity software vulnerability scored CVSS 7.5, first published 2026-06-08 and last reviewed 2026-09-10. It has no confirmed attribution, affects SolarWinds Serv-U (FTP Server / Managed File Transfer), references 1 CVE (CVE-2026-28318), maps to 15 MITRE ATT&CK techniques (T1190, T1498, T1499), and is covered by 9 detection rules and 19 indicators of compromise.
- CVSS
- 7.5/10High
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 15MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 19Indicators of compromise
Key facts for TL-2026-0717
- Threat ID
- TL-2026-0717
- Also known as
- Serv-U deflate-bomb DoS
- Severity
- HIGH
- CVSS
- 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- government, financial, healthcare, technology, managed-file-transfer-operators
- Target regions
- North America, Europe, Asia
- Detection rules
- 9
- Indicators of compromise
- 19
- Updates
- 2026-09-10 · 2 updates · revalidated 2× · latest source
How SolarWinds Serv-U DoS (CVE-2026-28318) works
CVE-2026-28318 is an unauthenticated denial-of-service vulnerability in SolarWinds Serv-U (FTP/MFT) below 15.5.4 HF1. An attacker sends an HTTP POST carrying a 'Content-Encoding: deflate' header, forcing the management web service to decompress attacker-controlled data without bounds, exhausting CPU/memory and crashing the service. CISA added it to the KEV catalog on 2026-06-05 amid confirmed in-the-wild exploitation, with a federal remediation deadline of 2026-06-19.
CVE-2026-28318 is an uncontrolled resource consumption (CWE-400) flaw in the SolarWinds Serv-U managed file transfer and FTP server. The Serv-U HTTP/HTTPS management and client interface accepts request bodies annotated with a 'Content-Encoding: deflate' header even on endpoints where compressed input is neither expected nor required. When such a request arrives, Serv-U inflates the supplied deflate stream into an in-memory buffer before any authentication or size validation occurs. Because the inflation routine does not enforce a decompressed-size ceiling or a compression-ratio limit, a small, highly compressible payload (a classic 'zip bomb' / 'deflate bomb' pattern) expands to hundreds of megabytes or gigabytes in memory. A handful of concurrent requests drive the worker process into sustained CPU saturation and memory exhaustion, causing the Serv-U service to become unresponsive or terminate. The attack requires no credentials and only network reachability to the listening management port (default 443/TCP, also 80/TCP), making any internet-exposed Serv-U instance trivially crashable.
The exploit primitive is a single, well-formed HTTP POST: the attacker compresses a long run of repeated bytes (for example a multi-megabyte string of null bytes or 'A' characters) with raw DEFLATE, sets 'Content-Encoding: deflate' and a small, plausible 'Content-Length', and posts it to any handled path. The decompression amplification ratio for such input commonly exceeds 1000:1, so a ~10 KB request body can force gigabyte-scale allocation. Reliability is high and the attack is repeatable; recovery requires a process or host restart. No code execution, data disclosure, or persistence results — impact is strictly availability (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Exploitation observed in the wild has been opportunistic and automated: mass scanning of Shodan/Shadowserver-indexed Serv-U hosts (~12,000 and ~3,100 exposed respectively) followed by repeated deflate-bomb POSTs to keep targets offline. Because the malicious request is structurally indistinguishable from a benign compressed upload except for the anomalous header on non-upload endpoints and the extreme decompression ratio, detection relies on request-header inspection, decompressed-size accounting at the proxy/WAF, and host telemetry for sudden Serv-U memory/CPU spikes and service crashes. SolarWinds remediated the issue in Serv-U 15.5.4 HF1 by rejecting unexpected Content-Encoding and bounding decompression.
MITRE ATT&CK techniques used in TL-2026-0717
Initial Access
T1190 Exploit Public-Facing Application
Impact
T1498 Network Denial of Service; T1499 Endpoint Denial of Service; T1499.002 Endpoint Denial of Service: Service Exhaustion Flood; T1499.004 Endpoint Denial of Service: Application or System Exploitation
Resource Development
T1583.003 Acquire Infrastructure: Virtual Private Server; T1587.004 Develop Capabilities: Exploits; T1588.005 Obtain Capabilities: Exploits; T1588.006 Obtain Capabilities: Vulnerabilities
Reconnaissance
T1590.005 Gather Victim Network Information: IP Addresses; T1592.002 Gather Victim Host Information: Software; T1595 Active Scanning; T1595.001 Active Scanning: Scanning IP Blocks; T1595.002 Active Scanning: Vulnerability Scanning; T1596.005 Search Open Technical Databases: Scan Databases
Affected products and versions in SolarWinds Serv-U DoS (CVE-2026-28318)
- SolarWinds — Serv-U (FTP Server / Managed File Transfer)
Vulnerable versions: All versions prior to 15.5.4 HF1
Fixed in: 15.5.4 HF1
Remediation for SolarWinds Serv-U DoS (CVE-2026-28318)
Patches
- SolarWinds Serv-U 15.5.4 HF1
Immediate actions
- Upgrade SolarWinds Serv-U to 15.5.4 HF1 (the fixed release) before the CISA KEV deadline of 2026-06-19
- Restrict access to the Serv-U management/web interface to known, trusted source IP ranges
- Block or strip the 'Content-Encoding' request header at an upstream WAF/reverse proxy for Serv-U endpoints that do not require it
Workarounds
- Drop inbound requests containing a 'Content-Encoding: deflate' (or gzip) header to the Serv-U HTTP/HTTPS listener
- Rate-limit unauthenticated POST requests to the Serv-U management ports (80/443)
Longer-term hardening
- Remove direct internet exposure of Serv-U; front it with a reverse proxy or VPN-gated access
- Enforce decompressed-size and compression-ratio limits at the WAF for all inbound compressed bodies
- Deploy host monitoring that alerts on Serv-U process memory/CPU exhaustion and unexpected service termination
CVEs associated with SolarWinds Serv-U DoS (CVE-2026-28318)
Weaknesses (CWE) in SolarWinds Serv-U DoS (CVE-2026-28318)
Timeline of SolarWinds Serv-U DoS (CVE-2026-28318)
- GitHub Advisory Database publishes GHSA-4vx4-vp54-mwmc, classifying the flaw as CWE-400 with an EPSS score of 40.012% (99th percentile).
- CVE-2026-28318 publicly disclosed with CVSS 3.1 base score 7.5 (availability-only impact).
- SolarWinds releases Serv-U 15.5.4 HF1, fixing CVE-2026-28318 by rejecting unexpected Content-Encoding and bounding decompression.
- Opportunistic, automated mass-scanning and deflate-bomb POST exploitation observed against internet-exposed Serv-U hosts.
- CISA adds CVE-2026-28318 to the Known Exploited Vulnerabilities catalog citing confirmed in-the-wild exploitation.
- Shodan indexes ~12,000 internet-exposed Serv-U servers; Shadowserver tracks ~3,100, defining the attack surface.
- BleepingComputer, SecurityWeek, and Help Net Security report active exploitation and urge immediate patching.
- Singapore's Cyber Security Agency issues regional alert AL-2026-069 covering CVE-2026-28318 and recommending immediate upgrade to 15.5.4 Hotfix 1.
- Bitdefender's June 2026 Threat Debrief cites CVE-2026-28318 exploitation and draws a historical parallel to Clop/TA505's prior use of Serv-U flaws for ransomware intrusions (unconfirmed for the current campaign).
- Bishop Fox publishes a root-cause teardown showing the crash is an invalid free() / heap corruption reached because Serv-U's deflate-body rejection check only runs when HTTP compression is disabled (compression ships enabled by default) — not a decompression-bomb amplification as initially assessed. Bishop Fox evaluated three RCE paths from the corruption primitive and found all three blocked by value constraints; impact remains denial-of-service only.
- CISA BOD 22-01 federal remediation deadline for CVE-2026-28318.
- Shodan-indexed internet-facing Serv-U instance count falls to under 10,000 (from over 12,000 at KEV addition) as fleet-wide patching progresses.
Update history for TL-2026-0717
- 2026-09-10 — CVE-2026-28318: SolarWinds Serv-U Unauthenticated Heap Corruption DoS, Actively Exploited: What changed No change to severity/exploitability/CVSS/status (HIGH/ACTIVE/7.5/ACTIVE all unchanged). Root-cause understanding deepened: added CWE-763 (Release of Invalid Pointer or Reference) alongside the existing CWE-400, reflecting Bish
- 2026-08-27 — SolarWinds Serv-U Denial-of-Service Flaw (CVE-2026-28318) Actively Exploited — Added to CISA KEV Catalog: What changed No field escalations. Root-cause mechanism materially clarified: Bishop Fox's 2026-06-17 analysis attributes the crash to an invalid free()/heap corruption reached via inverted safety-check logic (the deflate-rejection check on
Sources cited for SolarWinds Serv-U DoS (CVE-2026-28318)
- CISA Known Exploited Vulnerabilities Catalog
- CISA: Hackers now exploit SolarWinds Serv-U flaw to crash servers
- SolarWinds Patches Exploited Serv-U Vulnerability
- CISA: Patch actively exploited SolarWinds Serv-U DoS vulnerability (CVE-2026-28318)
- NVD — CVE-2026-28318
- SolarWinds Serv-U Release Notes — 15.5.4 HF1
- CWE-400: Uncontrolled Resource Consumption
Detection coverage for TL-2026-0717
As of 2026-09-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0717 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.