CVE-2026-28318: HIGH (CVSS 7.5), Actively Exploited (CISA KEV)

HIGH (CVSS 7.5), Actively Exploited (CISA KEV), EPSS 10.7%. SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate. Mitigation steps are provided to secure customer environments in the SolarWinds Trust Center if you are unable to deploy the update