SolarWinds Serv-U Zero-Day Added to CISA KEV Catalog

CISA's addition of CVE-2026-28318 to the Known Exploited Vulnerabilities catalog signals that attackers are actively exploiting an uncontrolled resource consumption flaw in SolarWinds Serv-U file transfer software. This vulnerability could allow attackers to exhaust system resources, leading to denial of service or potentially creating conditions for further exploitation. The KEV designation means federal agencies and critical infrastructure organizations must treat this as an emergency requiring immediate patching. Organizations running Serv-U should assume they are at immediate risk and prioritize remediation efforts.

Tactical Insight

Immediate actions

Apply security patches for SolarWinds Serv-U immediately or disable the service until patching is complete
Scan all network assets to identify instances of vulnerable Serv-U installations
Monitor affected systems for signs of resource exhaustion or unusual activity

Long-term improvements

Establish automated vulnerability scanning and patch management processes for all internet-facing services
Implement network segmentation to isolate file transfer services from critical business systems
Create emergency response procedures specifically for zero-day vulnerabilities in critical infrastructure

Detection measures

Deploy monitoring tools to detect resource consumption anomalies on file transfer servers
Enable comprehensive logging for all Serv-U authentication and file transfer activities