PT-2026-61973

Name of the Vulnerable Software and Affected Versions SolarWinds Serv-U affected versions not specified Description SolarWinds Serv-U contains a stored cross-site scripting XSS flaw. This issue allows an authenticated attacker to inject malicious scripts that are stored on the server, which can...

PT-2026-61965

Name of the Vulnerable Software and Affected Versions SolarWinds Serv-U affected versions not specified Description SolarWinds Serv-U contains a privilege escalation flaw that enables a domain administrator to elevate their privileges to those of a system administrator. The impact of this issue i...

PT-2026-61962

Name of the Vulnerable Software and Affected Versions SolarWinds Serv-U affected versions not specified Description An insecure direct object reference IDOR issue allows an attacker with group administrator access to achieve privilege escalation and remote code execution as root. IDOR is a type o...

PT-2026-61967

Name of the Vulnerable Software and Affected Versions SolarWinds Serv-U affected versions not specified Description SolarWinds Serv-U contains an insecure direct object reference IDOR flaw, which occurs when an application provides direct access to objects based on user-supplied input. This issue...

PT-2026-61970

Name of the Vulnerable Software and Affected Versions SolarWinds Serv-U affected versions not specified Description SolarWinds Serv-U contains a privilege escalation flaw that allows a group to elevate its access to system administrator levels. This can lead to arbitrary code execution with root...

PT-2026-61974

Name of the Vulnerable Software and Affected Versions SolarWinds Serv-U affected versions not specified Description SolarWinds Serv-U contains an insecure direct object reference IDOR flaw, which occurs when an application provides direct access to objects based on user-supplied input. This issue...

PT-2026-61966

Name of the Vulnerable Software and Affected Versions SolarWinds Serv-U affected versions not specified Description SolarWinds Serv-U contains a privilege escalation flaw that enables a domain user group to be elevated to an administrator group. The impact of this issue is reduced in Windows...

PT-2026-61971

Name of the Vulnerable Software and Affected Versions SolarWinds Serv-U affected versions not specified Description SolarWinds Serv-U contains an insecure direct object reference IDOR flaw. This issue allows for SMTP hijacking, which can result in arbitrary account takeover. The impact of this...

PT-2026-61972

Name of the Vulnerable Software and Affected Versions SolarWinds Serv-U affected versions not specified Description An insecure direct object reference IDOR issue exists that allows for account takeover. This occurs when an application provides direct access to objects based on user-supplied inpu...

PT-2026-61968

Name of the Vulnerable Software and Affected Versions SolarWinds Serv-U affected versions not specified Description Broken access control allows a domain administrator to create system administrator accounts. The impact of this issue is lower in Windows deployments. Recommendations At the moment,...

Exploit for Uncontrolled Resource Consumption in Solarwinds Serv-U

SolarWinds Serv-U Unauthenticated DoS: Safe Detection Script...

Exploit for Uncontrolled Resource Consumption in Solarwinds Serv-U

CVE-2026-28318 — SolarWinds Serv-U "Content-Encoding: deflate"...

SolarWinds Serv-U 15.5.0 < 15.5.5

The version of SolarWinds Serv-U installed on the remote host is prior to 15.5.4 HF1. It is, therefore, affected by a vulnerability as referenced in the solarwindsserv-u1554hf1 advisory. - SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without...

CISA Adds Actively Exploited SolarWinds Serv-U DoS Flaw to KEV Catalog

The U.S. Cybersecurity and Infrastructure Security Agency CISA has added a high-severity security flaw impacting SolarWinds Serv-U multi-protocol file server software to its Known Exploited Vulnerabilities KEV catalog, citing evidence of active exploitation. The vulnerability, tracked as...

CVE-2026-28318

SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate. Mitigation steps are provided to secure customer environments in the SolarWinds Trust Center if you are unable to deploy the update...

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities KEV Catalog, based on evidence of active exploitation. CVE-2026-28318link is external SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability This type of vulnerability is a frequent attack vector for malicious...

The vulnerability was exploited in SolarWinds Serv-U.

SolarWinds has identified a vulnerability in Serv-U. A malicious individual could exploit this vulnerability to cause a Denial-of-Service attack by sending a specially crafted POST message. SolarWinds has released a hotfix and published mitigation measures to address this vulnerability and preven...

SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability

SolarWinds Serv-U contains an uncontrolled resource consumption vulnerability that allows specially crafted POST requests using the Content-Encoding: deflate header to crash the Serv-U service without authentication...

VulnCheck KEV: CVE-2026-28318

SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate. Mitigation steps are provided to secure customer environments in the SolarWinds Trust Center if you are unable to deploy the update...

CVE-2026-28318 SolarWinds Serv-U Unauthenticated Denial of Service Vulnerability

SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate. Mitigation steps are provided to secure customer environments in the SolarWinds Trust Center if you are unable to deploy the update...