Back Scworld

Hackers actively exploit SolarWinds Serv-U flaw to crash servers, CISA warns

Scworld • June 5, 2026

Hackers are actively exploiting a recently patched high-severity SolarWinds Serv-U flaw, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned today. The vulnerability allows attackers to crash servers through specially crafted requests, with further coverage provided by Bleeping Computer.

The vulnerability, tracked as CVE-2026-28318, is a denial-of-service flaw in SolarWinds Serv-U file transfer software. Attackers can exploit it with low-complexity, unauthenticated POST requests that cause the Serv-U service to crash. CISA has added this vulnerability to its Known Exploited Vulnerabilities Catalog and mandated federal agencies to patch by June 19. While the mandate applies to U.S. government agencies, CISA urges all organizations, including the private sector, to apply mitigations or discontinue use if unavailable.

This Serv-U flaw follows a history of vulnerabilities in SolarWinds products being exploited by various threat actors, including ransomware gangs and state- groups, highlighting the ongoing risks associated with unpatched software in critical infrastructure.

Source: Bleeping Computer

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Active Exploitation of SolarWinds Serv-U Flaw CVE-2026-28318 The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning regarding the active exploitation of a high-severity vulnerability in SolarWinds Serv-U, tracked as CVE-2026-28318. This flaw allows remote attackers to crash the Serv-U service using specially crafted POST requests without requiring authentication. The vulnerability stems from uncontrolled resource consumption and affects both Windows and Linux versions of Serv-U. SolarWinds released a hotfix (15.5.4 Hotfix 1) on June 4, 2026, to address this issue. CISA has added this CVE to its Known Exploited Vulnerabilities Catalog and mandated that all Federal Civilian Executive Branch agencies patch their servers by June 19, 2026. There are over 12,000 Serv-U servers exposed online, increasing the risk of exploitation. Administrators are advised to limit access to known addresses and block specific POST requests until the patch can be applied. 13 sources 73

Extracted Entities

Hackers actively exploit SolarWinds Serv-U flaw to crash servers, CISA warns

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

Platforms (1)