CISA: Hackers are now exploiting flaws in SolarWinds Serv-U to crash servers

The U.S. Cybersecurity and Infrastructure Safety Company (CISA) at this time warned that hackers are actively exploiting a not too long ago patched high-severity flaw in SolarWinds Serv-U to crash servers.

Serv-U is the corporate’s file switch software program for Home windows and Linux that gives managed file switch (MFT) and FTP server performance, permitting customers to securely alternate recordsdata over HTTP/HTTPS, FTP, FTPS, and SFTP.

SolarWinds on Thursday launched Serv-U 15.5.4 Hotfix 1 to repair this denial of service vulnerability (tracked as CVE-2026-28318), which it stated is because of an uncontrolled useful resource consumption vulnerability.

“SolarWinds Serv-U is prone to specifically crafted POST requests that crash the Serv-U service with out authentication utilizing Content material-Encoding: deflate,” the corporate stated.

A distant attacker may exploit the safety flaw with out privilege in a low-complexity assault that doesn’t require consumer interplay.

SolarWinds additionally suggested directors who can not instantly deploy the patch to limit entry to identified addresses and block POST requests containing “content material encoding,” because the susceptible Serv-U service doesn’t require this performance.

Web intelligence platform Shodan at present tracks greater than 12,000 Serv-U servers on-line and Web safety watchdog Shadowserver tracks simply over 3,100 servers, however there isn’t a info on what number of servers have already been patched.

Days after SolarWinds addressed the vulnerability, CISA flagged the vulnerability as being exploited within the wild, added it to its catalog of identified and exploited vulnerabilities, and ordered all federal civilian government department businesses to patch their servers towards the continued assault by June 19, as required by Binding Operational Directive (BOD) 22-01.

Though BOD 22-01 solely applies to U.S. authorities businesses, the Cybersecurity Company known as on all community defenders, together with these within the non-public sector, to guard their networks from the continued CVE-2026-28318 assault as quickly as potential.

“A lot of these vulnerabilities are a frequent assault vector by malicious cyber attackers and pose important dangers to federal enterprises,” CISA warned. “Apply mitigations as directed by the seller and comply with the BOD 22-01 steering relevant to your cloud service, or discontinue use of the product if mitigations usually are not obtainable.”

In recent times, a number of cybercrime and state-sponsored hacking teams have focused Serv-U vulnerabilities to steal delicate company and buyer knowledge.

For instance, the Clop ransomware collective exploited the Serv-U distant code execution vulnerability (CVE-2021-35211) to infiltrate company networks in a 2021 marketing campaign. DEV-0322 Chinese language hackers additionally deployed the CVE-2021-35211 exploit in zero-day assaults beginning in July 2021.

Most not too long ago, in June 2024, cybersecurity firms GreyNoise and Rapid7 tagged the Serv-U path traversal vulnerability (CVE-2024-28995) as being actively exploited.

Over the previous few years, CISA has tagged 11 vulnerabilities in varied SolarWinds merchandise as being actively exploited in assaults, together with one by a ransomware gang.