← back | CVE Intelligence

CVE-2026-28318 [High] [Actively exploited]

Curated 2 security research writeups, vulnerability advisories and exploitation analyses for CVE-2026-28318.

CVSS: 7.5
Exploit Status: Actively exploited
Coverage Span: 2026-06-07 → 2026-06-16
Reports: 2 related reports

Associated Reports & Timeline

A Crash, Not a Shell: SolarWinds Serv-U CVE-2026-28318

Bishop Fox confirms CVE-2026-28318: one unauthenticated POST with a deflate Content-Encoding crashes SolarWinds Serv-U via heap corruption, but three probed RCE paths dead-end; HF1 fixes it.

CVE-2026-28318 — SolarWinds Serv-U HTTP Deflate Uncontrolled Resource Consumption

SolarWinds Serv-U's HTTP deflate handler decompresses small POST bodies into gigabytes of memory, crashing the service without authentication. Fixed in 15.5.4 Hotfix 1 and listed in CISA's KEV.