---
id: 3810
title: "A Crash, Not a Shell: SolarWinds Serv-U CVE-2026-28318"
cve: CVE-2026-28318
cvss: 7.5
severity: high
source_domain: bishopfox.com
source_url: "https://bishopfox.com/blog/a-crash-not-a-shell-solarwinds-serv-u-cve-2026-28318"
published_at: "2026-06-16 00:00"
tags: ["active-exploitation", "rce", "vulnerability-research", "denial-of-service", "solarwinds", "serv-u", "cve-2026-28318", "heap-corruption"]
phying_url: "https://phying.com/item/3810"
lang: en
---

# A Crash, Not a Shell: SolarWinds Serv-U CVE-2026-28318

## Summary

Bishop Fox confirms CVE-2026-28318: one unauthenticated POST with a deflate Content-Encoding crashes SolarWinds Serv-U via heap corruption, but three probed RCE paths dead-end; HF1 fixes it.

## Intelligence Metadata

- **Sources:** bishopfox.com
- **CVE:** CVE-2026-28318
- **CVSS:** 7.5
- **Published:** 2026-06-16 00:00
- **Original:** https://bishopfox.com/blog/a-crash-not-a-shell-solarwinds-serv-u-cve-2026-28318
- **Phying News:** https://phying.com/item/3810