Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

CISA KEV order for SolarWinds Serv-U CVE-2026-28318

Public Sector Action
First reported
Last updated
Happening score
H score 50
2 unique sources, 2 articles

Summary

Hide ▲

CISA added CVE-2026-28318 affecting SolarWinds Serv-U to the KEV catalog and ordered FCEB agencies to remediate it by June 19, 2026. The directive expands operational urgency for federal civilian environments because the flaw is tied to active exploitation. SolarWinds says the issue is fixed in Serv-U 15.5.4 HF1.

Related Happenings

SolarWinds Serv-U advisory and mitigations for CVE-2026-28318

Advisory/Mitigation
H score52 First: 06.06.2026 11:14 Last: 06.06.2026 11:14 Sources 1

How related: The issue has been addressed in SolarWinds Serv-U version 15.5.4 HF1. As mitigations, it's advised to limit access to known addresses and block any request containing "content-encoding" since the vulnerable service does not require this functionality.

About this happening: SolarWinds Serv-U mitigation guidance now covers CVE-2026-28318, reducing unauthenticated DoS risk from specially crafted POST requests. SolarWinds says the flaw is ad...

Open Happening

SolarWinds Serv-U denial-of-service flaw actively exploited (CVE-2026-28318)

Vulnerability
H score73 First: 05.06.2026 22:15 Last: 05.06.2026 22:15 Sources 1

How related: The vulnerability, tracked as CVE-2026-28318 (CVSS score: 7.5), is a denial-of-service (DoS) bug that causes the service to crash under certain conditions.

About this happening: CISA added CVE-2026-28318 affecting SolarWinds Serv-U to the Known Exploited Vulnerabilities (KEV) catalog after evidence of active exploitation. The high-se...

Open Happening

SolarWinds security patch release for CVE-2026-28318

Security Patch Release
H score82 First: 05.06.2026 22:15 Last: 05.06.2026 22:15 Sources 1

How related: The flaw was addressed in Serv-U 15.5.4 Hotfix 1.

About this happening: SolarWinds released Serv-U 15.5.4 Hotfix 1 for CVE-2026-28318, an actively exploited denial-of-service flaw that can crash exposed Serv-U servers. The update fixes...

Open Happening

PAN-OS GlobalProtect CVE-2026-0257 exploitation wave

Exploitation Wave
H score18 First: 01.06.2026 11:30 Last: 01.06.2026 11:30 Sources 1

About this happening: A CVE-2026-0257 exploitation wave is hitting Palo Alto Networks PAN-OS GlobalProtect appliances, creating unauthorized VPN access risk for multiple customers. Ra...

Open Happening

CISA KEV listing and FCEB patch order for CVE-2026-35616

Public Sector Action
H score53 First: 06.04.2026 19:02 Last: 06.04.2026 19:02 Sources 1

About this happening: CISA added CVE-2026-35616 to the KEV Catalog and ordered FCEB agencies to patch FortiClient EMS by Thursday midnight, April 9. The mandate matters because...

Open Happening

Timeline

  1. 06.06.2026 11:14 3 articles · 1mo ago

    CISA adds SolarWinds Serv-U CVE-2026-28318 to KEV catalog

    Industry Or Public Sector Update

    CISA added CVE-2026-28318 affecting SolarWinds Serv-U multi-protocol file server software to its Known Exploited Vulnerabilities (KEV) catalog after evidence of active exploitation. CISA described the flaw as an uncontrolled resource consumption vulnerability that results in a denial-of-service (DoS) condition, and SolarWinds said specially crafted POST requests using Content-Encoding: deflate can crash the Serv-U service without authentication. SolarWinds says the issue is addressed in SolarWinds Serv-U version 15.5.4 HF1.

    Show sources
    Open in new tab
  2. 06.06.2026 11:14 1 articles · 1mo ago

    FCEB agencies must address SolarWinds Serv-U CVE-2026-28318 by June 19, 2026

    Legal Policy Action Update

    Federal Civilian Executive Branch agencies must address CVE-2026-28318 by June 19, 2026. The flaw affects SolarWinds Serv-U multi-protocol file server software and can crash the service without authentication through specially crafted POST requests using Content-Encoding: deflate; SolarWinds says the issue is addressed in SolarWinds Serv-U version 15.5.4 HF1.

    Show sources
    Open in new tab