CISA Adds Actively Exploited SolarWinds Serv-U DoS Flaw to KEV Catalog

CISA Adds Actively Exploited SolarWinds Serv-U DoS Flaw to KEV Catalog Ravie LakshmananJun 06, 2026Vulnerability / Patch Management The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity security flaw impacting SolarWinds Serv-U multi-protocol file server software to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerability, tracked as CVE-2026-28318 (CVSS score: 7.5), is a denial-of-service (DoS) bug that causes the service to crash under certain conditions. CISA described it as an uncontrolled resource consumption vulnerability that results in a DoS condition. "SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate," SolarWinds said in an advisory released earlier this week. The issue has been addressed in SolarWinds Serv-U version 15.5.4 HF1. As mitigations, it's advised to limit access to known addresses and block any request containing "content-encoding" since the vulnerable service does not require this functionality. There are currently no details on how the vulnerability is being exploited in real-world attacks, or who is behind them. It's also unclear how many internet-exposed Serv-U instances are compromised, if any. CISA has ordered Federal Civilian Executive Branch (FCEB) agencies to address the flaw by June 19, 2026. In the past, multiple flaws in Serv-U have been exploited by bad actors, including those associated with the Cl0p ransomware gang. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share SHARE  CISA, cybersecurity, denial of service, KEV Catalog, Patch Management, ransomware, Serv-U, SolarWinds, Vulnerability ⚡ Top Stories This Week Threat Actors Exploit Critical FortiClient EMS Flaw to Deploy Credential Stealer Malicious npm Package Stole Files From Claude AI User Directory via GitHub ⚡ Weekly Recap: New Linux Flaw, PAN-OS Exploit, AI-Powered Attacks, OAuth Phishing and More ChatGPhish Vulnerability Turns ChatGPT Web Summaries Into a Phishing Surface PAN-OS GlobalProtect Authentication Bypass (CVE-2026-0257) Under Active Exploitation Oracle WebLogic CVE-2024-21182 Added to KEV Catalog After Active Exploitation Google June 2026 Android Update Patches 124 Flaws, One Actively Exploited GlassWorm Malware Takedown Disrupts Developer Supply Chain Attack Infrastructure Dashlane Discloses Brute-Force Attack, Encrypted Vaults of Fewer Than 20 Users Downloaded OpenAI Codex Authentication Tokens Stolen in codexui-android npm Supply Chain Attack AI Chatbot Recommendations Redirect Users to Cryptojacking Malware Sites ThreatsDay Bulletin: Claude Security Plugin, Azure Priv-Esc, Kali365 MFA Bypass, FIFA Scams +15 More Microsoft Patches SharePoint RCE Flaw CVE-2026-45659 Across Server Versions Attackers Use LLM Agent for Post-Exploitation After Marimo CVE-2026-39987 Exploit Miasma Supply Chain Attack Compromises Red Hat npm Packages with Credential-Stealing Worm Microsoft Slams Public Zero-Day Disclosures Amid GitHub Researcher Account Removal Load More ▼ ⭐ Featured Resources [Guide] The Real Security Risks of Shadow AI (And Where You’re Exposed) Watch AI Turn Vulnerabilities Into Working Exploits in Minutes (See the Demo) Learn How to Stop Attacks Before They Reach Your EDR – With PHASR Your Employees Are Using AI in Ways You Can’t See – 2026 State of AI Report