NewsCompaniesFlawsGuides
Get the app
HighFixedBeing used in attacksClosedUpdated

SolarWinds Serv-U crash flaw CVE-2026-28318 used in attacks; Hotfix 1 available

Attackers are exploiting CVE-2026-28318 to crash SolarWinds Serv-U file-transfer servers without signing in. Version 15.5.4 and earlier are affected. Ask your IT provider to install 15.5.4 Hotfix 1; older installations must first upgrade to 15.5.4.

What to do

If your family office or business uses Serv-U, ask its IT provider to install Serv-U 15.5.4 Hotfix 1, upgrading to 15.5.4 first if necessary. Until it can update, SolarWinds recommends restricting access to known addresses and applying its web application firewall controls.

What’s happening

SolarWinds Serv-U, file-transfer server software for Windows and Linux, has a resource-consumption flaw that lets remote attackers crash the service without an account or user interaction. SolarWinds lists version 15.5.4 and earlier as affected and rates CVE-2026-28318 high severity, with a score of 7.5. Its advisory is dated 3 June, and its release notes date the fix, 15.5.4 Hotfix 1, to 4 June. Older installations must first upgrade to 15.5.4 before applying that hotfix. CISA confirmed exploitation on 5 June. The attackers' identities and whether attacks began before the fix remain unknown in the reporting reviewed. As of 3 November, the reviewed guidance still identifies Hotfix 1 as the fix; no later change to that guidance was found.

What
Flaw
Affects
SolarWinds Serv-U file-transfer server
Affected
SolarWinds Serv-U 15.5.4 and below
Fixed in
SolarWinds Serv-U 15.5.4 HF1
CVE
CVE-2026-28318
Since
3 June 2026
Closed
9 June 2026

Timeline

  1. Update

    Singapore's Cyber Security Agency also warned that attackers were exploiting the flaw and urged immediate installation of Serv-U 15.5.4 Hotfix 1.

  2. CISA added

    CISA added CVE-2026-28318 to its Known Exploited Vulnerabilities catalogue, confirming use in attacks. It set a 19 June remediation deadline for US federal civilian agencies.

  3. New fixFixed

    SolarWinds released Serv-U 15.5.4 Hotfix 1 to fix CVE-2026-28318. Administrators must install version 15.5.4 before applying the hotfix.

  4. Made public

    SolarWinds dates its first advisory to 3 June. It identifies a flaw that lets someone crash Serv-U remotely without signing in, affecting version 15.5.4 and earlier.

Sources

  1. SolarWinds Serv-U Unauthenticated Denial of Service Vulnerability (CVE-2026-28318)SolarWinds · 3 June 2026
  2. Serv-U 15.5.4 Hotfix 1 release notesSolarWinds · 4 June 2026
  3. CISA: Hackers now exploit SolarWinds Serv-U flaw to crash serversBleepingComputer · 5 June 2026
  4. SolarWinds Serv-U Vulnerability Exploited in the WildSecurityWeek · 8 June 2026
  5. High-Severity Vulnerability in SolarWinds Serv-UCyber Security Agency of Singapore · 9 June 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from June 2026 · JSON · RSS