SolarWinds Serv-U CVE-2026-28318 Service Crash Vulnerability Advisory and Fix

Vulnerability Overview Vulnerability ID: CVE-2026-28318 Vulnerability Title: Unauthenticated Service Vulnerability in SolarWinds Serv-U Description: SolarWinds Serv-U is vulnerable to specially crafted POST requests, which can cause the Serv-U service to crash without the use of . Mitigation steps include securing the service environment; if an update cannot be deployed, please visit the SolarWinds Trust Center. Severity: 7.5 High Affected Versions Affected Versions: Serv-U 15.5.4 Hotfix 1 Remediation Steps Installation Instructions 1. Close all running Serv-U processes - Right-click the tray icon and select "Stop Serv-U". - Right-click the tray icon and select "Exit Tray". 2. Back up the following files - Windows OS: - - - - - - - - - Linux OS: - - - 3. Extract the hotfix archive to a temporary location 4. Open the folder for the Serv-U installation platform - For example, for the 64-bit version of Linux, open the folder. 5. On Linux, modify file permissions - Execute the following command: 6. Copy the folder contents to the Serv-U installation directory - Default Windows installation directory: - Default Linux installation directory: 7. Launch the Serv-U tray application 8. Right-click the Serv-U tray icon and select "Start Serv-U" - The hotfix is installed. Uninstallation Instructions 1. Close all running Serv-U processes - Right-click the tray icon and select "Stop Serv-U". - Right-click the tray icon and select "Exit Tray". 2. Replace the following files with the backed-up files - Windows OS: - - - - - - - - - Linux OS: - - - 3. Launch the Serv-U tray application 4. Right-click the Serv-U tray icon and select "Start Serv-U" - The hotfix is uninstalled. Results Attackers can no longer cause the Serv-U service to crash by sending a simple request with and some data. Additional Information Release Date: June 4, 2026 Contact Technical Support: https://customerportal.solarwinds.com/support/submit-a-ticket Legal Notice Copyright: © 2026 SolarWinds Worldwide, LLC. All rights reserved. Disclaimer: SolarWinds provides no warranties, express or implied, including but not limited to the warranties of merchantability, fitness for a particular purpose, and non-infringement. Under no circumstances shall SolarWinds and its suppliers be liable for any damages, whether based on contract, tort, or other legal theory. Lifecycle Version 15.5.1: - EoL Announcement Date: November 18, 2025 - EoE Effective Date: February 18, 2026 - EoL Effective Date: November 18, 2026 Version 15.5: - EoL Announcement Date: July 8, 2025 - EoE Effective Date: October 8, 2025 - EoL Effective Date: August 8, 2026 Version 15.4.2: - EoL Announcement Date: April 15, 2025 - EoE Effective Date: July 15, 2025 - EoL Effective Date: July 15, 2026

Goal Reached Thanks to every supporter — we hit 100%!

SolarWinds Serv-U CVE-2026-28318 Service Crash Vulnerability Advisory and Fix