{"id":"solarwinds-servu-crash-attacks-jun-2026","category":"patch","status":"closed","title":"SolarWinds Serv-U crash flaw CVE-2026-28318 used in attacks; Hotfix 1 available","tldr":"Attackers are exploiting CVE-2026-28318 to crash SolarWinds Serv-U file-transfer servers without signing in. Version 15.5.4 and earlier are affected. Ask your IT provider to install 15.5.4 Hotfix 1; older installations must first upgrade to 15.5.4.","summary":"SolarWinds Serv-U, file-transfer server software for Windows and Linux, has a resource-consumption flaw that lets remote attackers crash the service without an account or user interaction. SolarWinds lists version 15.5.4 and earlier as affected and rates CVE-2026-28318 high severity, with a score of 7.5. Its advisory is dated 3 June, and its release notes date the fix, 15.5.4 Hotfix 1, to 4 June. Older installations must first upgrade to 15.5.4 before applying that hotfix. CISA confirmed exploitation on 5 June. The attackers' identities and whether attacks began before the fix remain unknown in the reporting reviewed. As of 3 November, the reviewed guidance still identifies Hotfix 1 as the fix; no later change to that guidance was found.","action":"If your family office or business uses Serv-U, ask its IT provider to install Serv-U 15.5.4 Hotfix 1, upgrading to 15.5.4 first if necessary. Until it can update, SolarWinds recommends restricting access to known addresses and applying its web application firewall controls.","product":"SolarWinds Serv-U file-transfer server","audience":"work","severity":"high","patch":"patched","exploited":true,"cves":["CVE-2026-28318"],"tags":["solarwinds","serv-u","file-transfer","denial-of-service","actively-exploited"],"affected":["SolarWinds Serv-U 15.5.4 and below"],"fixed":["SolarWinds Serv-U 15.5.4 HF1"],"matches":[],"sources":[{"kind":"advisory","title":"SolarWinds Serv-U Unauthenticated Denial of Service Vulnerability (CVE-2026-28318)","url":"https://www.solarwinds.com/trust-center/security-advisories/cve-2026-28318","by":"SolarWinds","date":"2026-06-03"},{"kind":"advisory","title":"Serv-U 15.5.4 Hotfix 1 release notes","url":"https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-5-4-hotfix-1_release_notes.htm","by":"SolarWinds","date":"2026-06-04"},{"kind":"news","title":"CISA: Hackers now exploit SolarWinds Serv-U flaw to crash servers","url":"https://www.bleepingcomputer.com/news/security/cisa-hackers-now-exploit-solarwinds-serv-u-flaw-to-crash-servers/","by":"BleepingComputer","date":"2026-06-05"},{"kind":"news","title":"SolarWinds Serv-U Vulnerability Exploited in the Wild","url":"https://www.securityweek.com/solarwinds-patches-exploited-serv-u-vulnerability/amp/","by":"SecurityWeek","date":"2026-06-08"},{"kind":"advisory","title":"High-Severity Vulnerability in SolarWinds Serv-U","url":"https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-069/","by":"Cyber Security Agency of Singapore","date":"2026-06-09"}],"started":"2026-06-03","closed":"2026-06-09","created":"2026-11-03T22:20:41.715Z","updated":"2026-11-03T22:20:41.715Z","cve_notes":[{"cve":"CVE-2026-28318","name":"Unauthenticated service crash in SolarWinds Serv-U","what":"A resource-consumption flaw in SolarWinds Serv-U's handling of compressed web requests lets a remote attacker crash the file-transfer service without signing in.","severity":"high","cvss":7.5}],"timeline":[{"at":"2026-06-09","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"Singapore's Cyber Security Agency also warned that attackers were exploiting the flaw and urged immediate installation of Serv-U 15.5.4 Hotfix 1.","url":"https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-069/","by":"Cyber Security Agency of Singapore","patch":null},{"at":"2026-06-05","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added CVE-2026-28318 to its Known Exploited Vulnerabilities catalogue, confirming use in attacks. It set a 19 June remediation deadline for US federal civilian agencies.","url":"https://www.bleepingcomputer.com/news/security/cisa-hackers-now-exploit-solarwinds-serv-u-flaw-to-crash-servers/","by":"BleepingComputer","patch":null},{"at":"2026-06-04","added":"2026-11-03T22:11:23.504Z","kind":"new-fix","text":"SolarWinds released Serv-U 15.5.4 Hotfix 1 to fix CVE-2026-28318. Administrators must install version 15.5.4 before applying the hotfix.","url":"https://documentation.solarwinds.com/en/success_center/servu/content/release_notes/servu_15-5-4-hotfix-1_release_notes.htm","by":"SolarWinds","patch":"patched"},{"at":"2026-06-03","added":"2026-11-03T22:11:23.504Z","kind":"disclosed","text":"SolarWinds dates its first advisory to 3 June. It identifies a flaw that lets someone crash Serv-U remotely without signing in, affecting version 15.5.4 and earlier.","url":"https://www.solarwinds.com/trust-center/security-advisories/cve-2026-28318","by":"SolarWinds","patch":null}],"url":"https://hard.fyi/live/solarwinds-servu-crash-attacks-jun-2026/","json":"https://hard.fyi/api/live?id=solarwinds-servu-crash-attacks-jun-2026"}