DaystoPatch

SolarWindsExploited incident

SolarWinds Serv-U Unauthenticated Denial of Service Vulnerability

CVE-2026-28318High, CVSS 7.5In CISA's Known Exploited Vulnerabilities catalog since 5 Jun 2026

  • Exploited after a fix existed
FixedFixed for every supported version 1 day after the first public report.

Response

Silence
same day
First public report to first vendor statement
Exposure
1d
First public report to first fix
Follow-through
1d
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    date only

    SolarWinds Trust Center advisory CVE-2026-28318CuratedQuote verified

    06/03/2026

    Value of the advisory's 'First Published' field (US date format, 3 June 2026). No earlier public report found; CISA added the CVE to KEV on 2026-06-05 without public detail on the exploitation.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:b7db515e8e637c01…
    Used in metrics
    Yes
    Dispute this timestamp
    4 more sources for this moment
    CVE.org record CVE-2026-28318ClaimedQuote verified4 Jun 2026, 14:05 UTC

    SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate. Mitigation steps are provided to secure

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ace57e62523050e9…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet4 Jun 2026, 20:01 UTC

    IOCs: CVE-2026-28299, CVE-2026-28318

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2026-28318)ClaimedQuote verified5 Jun 2026

    SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability

    Added to CISA's KEV catalog on 2026-06-05.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet5 Jun 2026, 19:36 UTC

    actively exploiting to crash servers with specially crafted POST requests. A denial-of-service vulnerability, tracked as CVE-2026-28318, can be triggered without authentication, posing a significant threat to… https:// osintsights.com/hackers-active ly-exploit-solarwinds-serv-u-flaw-to-crash-se

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    date onlysame day

    SolarWinds Trust Center advisory CVE-2026-28318CuratedQuote verified

    06/03/2026

    'First Published' field. Help Net Security (June 8, 2026) also says 'The vulnerability was disclosed by SolarWinds on June 3'.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:b7db515e8e637c01…
    Used in metrics
    Yes
    Dispute this timestamp

  3. First workaround

    date onlysame day

    SolarWinds Trust Center advisory CVE-2026-28318CuratedQuote verified

    SolarWinds suggests adding the following controls to your web access firewall.

    WAF mitigation (limit access to known addresses; block POST requests with a content-encoding header) is in the advisory first published 06/03/2026. The earliest Wayback capture of the advisory is 2026-06-06, so it is not independently confirmed that the mitigation text was present on 3 June.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:b7db515e8e637c01…
    Used in metrics
    Yes
    Dispute this timestamp

  4. First fix

    date only+1d

    SolarWinds Serv-U 15.5.4 Hotfix 1 release notesCuratedQuote verified

    Release date: June 4, 2026

    These release notes say 'Serv-U 15.5.4 Hotfix 1 provides bugfixes related to CVE-2026-28318.' Conflict: Help Net Security writes the bug 'was disclosed by SolarWinds on June 3, after it released Serv-U 15.5.4 Hotfix 1', implying the hotfix was out by 3 June; the vendor's own release notes say June 4, which is used here.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:8e60dd6963d2eb96…
    Used in metrics
    Yes
    Dispute this timestamp
    1 more source for this moment
    SolarWinds advisory CVE-2026-28318ClaimedQuote verified3 Jun 2026

    First Published 06/03/2026

    advisory published with fixed version: SolarWinds Serv-U 15.5.4 HF1

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:96bda09e8a5fe3f9…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  5. Fixed for all versions

    date only+1d

    SolarWinds Serv-U 15.5.4 Hotfix 1 release notesCuratedQuote verified

    Customers who downloaded and installed Serv-U 15.5.4 should also download and install Serv-U 15.5.4 Hotfix 1.

    Single fix release (15.5.4 HF1, release date June 4, 2026) for all affected versions ('SolarWinds Serv-U 15.5.4 and below'); users of older versions must upgrade.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:8e60dd6963d2eb96…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • SolarWinds Serv-U MFT Server
  • SolarWinds Serv-U FTP Server
How we built this timeline

Advisory (3 June) appears to precede the hotfix release-notes date (4 June) by one day; see First fix note for the conflicting Help Net Security wording. exploited before a fix=false under R4 (correction pass 23 Oct 2026; was null): the hotfix was public on 4 Jun 2026 and the earliest public evidence of exploitation is the CISA KEV listing of 5 Jun 2026; The Hacker News (Jun 06, 2026) says 'There are currently no details on how the vulnerability is being exploited'.

The advisory page header also shows 'Security Advisories | CVE-2026-28297', which appears to be a template artifact on SolarWinds' page. AUDIT 2 (T2): searched later reports (SecurityWeek, Help Net Security, vendor pages, web search for 'zero-day' reports) for exploitation before the 4 Jun 2026 hotfix;

SecurityWeek says it is unclear 'whether the vulnerability has been exploited as a zero-day' and no source dates exploitation earlier, so false stands.

Related

No related incidents.

SolarWinds report card