RiskEvents

Developing event. Generated by AI and subject to further corroboration and review.

DevelopingLow impactAI Refreshed

CISA Flags Active Exploitation of SolarWinds Serv-U DoS Flaw

Occurred 5 Jun 2026·Detected 5 Jun 2026·
🇺🇸 Global — affects internet-exposed SolarWinds Serv-U servers worldwide; US federal agencies under mandatory patch order3 reports
CyberPropertyCyberCasualty & Liability

CISA has added CVE-2026-28318, a high-severity unauthenticated denial-of-service vulnerability in SolarWinds Serv-U file transfer software, to its Known Exploited Vulnerabilities Catalog following confirmed in-the-wild exploitation. The flaw lets remote attackers crash Serv-U servers via crafted POST requests using 'Content-Encoding: deflate'. SolarWinds released Serv-U 15.5.4 Hotfix 1, and US Federal Civilian Executive Branch agencies must patch by June 19, 2026. Exposure estimates diverge between internet-scanning sources (Shodan ~12,000 vs Shadowserver ~3,100).

AI-generated from linked source reports. See our correction policy.

Impact verdict

Low impact. The vulnerability is a denial-of-service weakness causing server crashes rather than data exfiltration or ransomware deployment. No named insured commercial or industrial assets are confirmed affected, no credible loss estimates exist, and no claims, reserving, or underwriting actions are evidenced. Historical Serv-U exploitation by groups such as Clop warrants monitoring, but current exploitation appears confined to DoS, placing the event below the concrete London Market loss pathway threshold at this stage.

View assessment methodology

How we grade what we know -- Known · Reported · Uncertain. Methodology →

Intelligence ledger

Each line expands in place to its underlying sourced claim.

AI refreshed 14 Jun 2026, 05:24

Known16 lines

CISA has confirmed active exploitation of CVE-2026-28318 in the wild▾
structured lineknown
No separate sourced-claim record is available for this line yet.
SolarWinds released Serv-U 15.5.4 Hotfix 1 to patch the denial-of-service vulnerability▾
structured lineknown
No separate sourced-claim record is available for this line yet.
The flaw allows unauthenticated remote attackers to crash Serv-U servers via crafted POST requests▾
structured lineknown
No separate sourced-claim record is available for this line yet.
Shodan tracks over 12,000 Serv-U servers exposed online; Shadowserver counts just over 3,100▾
structured lineknown
No separate sourced-claim record is available for this line yet.
CISA has ordered US Federal Civilian Executive Branch agencies to patch by June 19, 2026▾
structured lineknown
No separate sourced-claim record is available for this line yet.
SolarWinds has advised blocking POST requests containing 'content-encoding' as a workaround▾
structured lineknown
No separate sourced-claim record is available for this line yet.
SolarWinds has advised blocking POST requests containing 'content-encoding' as a temporary workaround pending patching.▾
vendor_workaround_block_content_encoding_postremediation pathwayvalid from 5 Jun 2026, 20:24Cyber
Market relevance: Workaround provides a short-term compensating control but is not a substitute for patching.
BleepingComputer · 5 Jun 2026, 19:15 · trade media
CISA added CVE-2026-28318, a high-severity unauthenticated denial-of-service vulnerability in SolarWinds Serv-U, to the Known Exploited Vulnerabilities Catalog following confirmed in-the-wild exploitation.▾
cisa_kev_listingportfolio exposure signalvalid from 13 Jun 2026, 23:42Cyber
Market relevance: Cyber underwriters monitor CISA KEV additions for systemic risk signals across insured portfolios using Serv-U.
“CISA: Patch actively exploited SolarWinds Serv-U DoS vulnerability (CVE-2026-28318)” — r/cybersecurity · 8 Jun 2026, 12:04 · social community
“CISA: Hackers now exploit SolarWinds Serv-U flaw to crash servers” — r/cybersecurity · 6 Jun 2026, 10:49 · social community
“CISA has added CVE-2026-28318, a high-severity denial-of-service vulnerability in SolarWinds Serv-U file transfer software, to its Known Exploited Vulnerabilities Catalog following confirmed active exploitation.” — BleepingComputer · 5 Jun 2026, 19:15 · trade media
The flaw allows unauthenticated remote attackers to crash Serv-U servers via specially crafted POST requests using 'Content-Encoding: deflate', exploiting an uncontrolled resource consumption weakness in low-complexity attacks that do not require user interaction.▾
vulnerability_mechanismseverity floorvalid from 5 Jun 2026, 20:24Cyber
Market relevance: Defines the technical impact class of the event (DoS, not data loss or ransomware) and so bounds insured-loss expectations.
“SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate. Remote attackers can exploit the security flaw without privileges in low-complexity attacks that don't require user interaction.” — BleepingComputer · 5 Jun 2026, 19:15 · trade media
The flaw allows unauthenticated remote attackers to crash Serv-U servers via specially crafted POST requests using 'Content-Encoding: deflate', in low-complexity attacks requiring no user interaction.▾
vulnerability_mechanism_unauth_dosvulnerability exposurevalid from 5 Jun 2026, 20:24Cyber
Market relevance: Unauthenticated, low-complexity DoS raises the ease of opportunistic exploitation against any internet-exposed instance.
“Remote attackers can exploit the security flaw without privileges in low-complexity attacks that don't require user interaction.” — BleepingComputer · 5 Jun 2026, 19:15 · trade media
No named insured commercial or industrial assets are confirmed affected, no credible loss estimates exist, and no claims, reserving, or underwriting actions are evidenced at this stage.▾
no_confirmed_insured_impactloss pathway below thresholdvalid from 5 Jun 2026, 20:24Cyber
Market relevance: Absence of confirmed insured impact supports a 'low' materiality designation for the London Market at this time.
BleepingComputer · 5 Jun 2026, 19:15 · trade media
SolarWinds released Serv-U 15.5.4 Hotfix 1 to address the denial-of-service vulnerability.▾
patch_releasedremediation pathwayvalid from 13 Jun 2026, 23:42Cyber
Market relevance: Patch availability defines the remediation window and limits prolonged exposure for insured Serv-U users.
“SolarWinds released Serv-U 15.5.4 Hotfix 1 to patch the denial-of-service vulnerability” — BleepingComputer · 5 Jun 2026, 19:15 · trade media
CISA has ordered US Federal Civilian Executive Branch agencies to patch CVE-2026-28318 by June 19, 2026.▾
fceb_patch_deadlineremediation pathwayvalid from 13 Jun 2026, 23:42Cyber
Market relevance: Federal mandate is a leading indicator that drives private-sector patch velocity and so influences aggregate Serv-U exposure.
“CISA: Patch actively exploited SolarWinds Serv-U DoS vulnerability (CVE-2026-28318)” — r/cybersecurity · 8 Jun 2026, 12:04 · social community
“Federal agencies have been ordered to patch by June 19” — BleepingComputer · 5 Jun 2026, 19:15 · trade media
CISA has added CVE-2026-28318 to the Known Exploited Vulnerabilities Catalog following confirmed active exploitation in the wild.▾
cisa_known_exploited_vuln_listingincident response demandvalid from 5 Jun 2026, 20:24Cyber
Market relevance: CISA KEV listing and federal patch mandate raise baseline remediation urgency across US-exposed Serv-U deployments.
“SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate.” — BleepingComputer · 5 Jun 2026, 19:15 · trade media
CISA has ordered US Federal Civilian Executive Branch agencies to patch CVE-2026-28318 by June 19, 2026.▾
federal_patch_deadline_june_19regulatory directivevalid from 5 Jun 2026, 20:24Cyber
Market relevance: Federal mandate sets a concrete remediation timeline and signals elevated priority for public-sector insureds.
BleepingComputer · 5 Jun 2026, 19:15 · trade media
SolarWinds has released Serv-U 15.5.4 Hotfix 1 to remediate the denial-of-service vulnerability.▾
patch_released_serv_u_15_5_4_hf1remediation pathwayvalid from 5 Jun 2026, 20:24Cyber
Market relevance: Patch availability reduces residual exploitation risk for organisations that apply it promptly.
BleepingComputer · 5 Jun 2026, 19:15 · trade media

Reported5 lines

The vulnerability stems from an uncontrolled resource consumption weakness▾
structured linereported
No separate sourced-claim record is available for this line yet.
No information available on how many exposed servers have already been patched▾
structured linereported
No separate sourced-claim record is available for this line yet.
SolarWinds has advised blocking POST requests containing 'content-encoding' as an interim workaround.▾
vendor_workaroundremediation pathwayvalid from 13 Jun 2026, 23:42Cyber
Market relevance: Provides an immediate, vendor-recommended mitigation for insured Serv-U users unable to patch promptly.
“SolarWinds has advised blocking POST requests containing 'content-encoding' as a workaround” — BleepingComputer · 5 Jun 2026, 19:15 · trade media
Internet-scanning sources report differing exposure totals for Serv-U: Shodan tracks over 12,000 servers exposed online, while Shadowserver counts just over 3,100. The discrepancy likely reflects differing scanning methodologies and timing.▾
exposed_serv_u_instances_onlinevulnerability exposurevalid from 5 Jun 2026, 20:24Cyber
Market relevance: Exposed footprint size frames the maximum potential blast radius for opportunistic DoS campaigns.
BleepingComputer · 5 Jun 2026, 19:15 · trade media
Internet-scanning sources diverge on the number of Serv-U servers exposed online: Shodan tracks over 12,000, while Shadowserver counts just over 3,100.▾
exposed_serv_u_inventoryexposure estimatevalid from 13 Jun 2026, 23:42Cyber
Market relevance: Defines the upper bound of potentially affected insured Serv-U deployments; the wide spread between scanners limits precision.
“over 12,000 Serv-U servers currently exposed online” — BleepingComputer · 5 Jun 2026, 19:15 · trade media

Uncertain8 lines

Identity and attribution of the threat actors currently exploiting the flaw▾
structured lineuncertain
No separate sourced-claim record is available for this line yet.
Scale and scope of impact on private-sector organizations▾
structured lineuncertain
No separate sourced-claim record is available for this line yet.
Whether exploitation has progressed beyond denial-of-service to data exfiltration or ransomware delivery▾
structured lineuncertain
No separate sourced-claim record is available for this line yet.
It is unconfirmed whether exploitation of CVE-2026-28318 has progressed beyond denial-of-service to data exfiltration or ransomware delivery; historical Serv-U exploitation by groups such as Clop warrants monitoring.▾
exploitation_scope_progressionseverity uncertaintyvalid from 13 Jun 2026, 23:42Cyber
Market relevance: A confirmed shift from DoS to data exfiltration or ransomware would materially raise insured-loss expectations.
“potential denial-of-service and further intrusion implications for organizations running the affected software” — r/cybersecurity · 6 Jun 2026, 10:49 · social community
“Whether exploitation has progressed beyond denial-of-service to data exfiltration or ransomware delivery” — BleepingComputer · 5 Jun 2026, 19:15 · trade media
The identity and attribution of threat actors currently exploiting CVE-2026-28318 have not been publicly confirmed.▾
threat_actor_attributionseverity uncertaintyvalid from 13 Jun 2026, 23:42Cyber
Market relevance: Attribution affects ransomware/intrusion severity expectations for cyber insurers; current data is insufficient to support claims.
“Identity and attribution of the threat actors currently exploiting the flaw” — BleepingComputer · 5 Jun 2026, 19:15 · trade media
No reliable information is available on how many exposed Serv-U servers have already been patched in the private sector.▾
private_sector_patch_rateexposure uncertaintyvalid from 13 Jun 2026, 23:42Cyber
Market relevance: Patch progress is the key determinant of residual exposure for cyber underwriters; current visibility is limited.
“No information available on how many exposed servers have already been patched” — BleepingComputer · 5 Jun 2026, 19:15 · trade media
The identity and attribution of the threat actors currently exploiting CVE-2026-28318 are not publicly reported.▾
threat_actor_attribution_unknowncontextvalid from 5 Jun 2026, 20:24Cyber
Market relevance: Unattributed exploitation limits ability to map activity to known ransomware or state-aligned campaigns.
BleepingComputer · 5 Jun 2026, 19:15 · trade media
It is unconfirmed whether exploitation has progressed beyond denial-of-service to data exfiltration or ransomware delivery, though historical Serv-U flaws have been used by groups such as Clop for ransomware staging.▾
exploitation_scope_beyond_dos_unconfirmedcontextvalid from 5 Jun 2026, 20:24Cyber
Market relevance: Historical precedent of ransomware use of Serv-U flaws warrants monitoring for escalation, but no current evidence of such activity is reported.
BleepingComputer · 5 Jun 2026, 19:15 · trade media

Geographic Zone Matches

3 active matches

  • TRIA Certified Areas
    Rule-basedConfidence 100%
  • Pacific Ring of Fire
    Rule-basedConfidence 100%
  • Caribbean Hurricane Zone
    Rule-basedConfidence 100%

Geographic zone matches are RiskEvents spatial/analytical indicators, not coverage determinations or Lloyd's official classifications.

Affected countries

🇺🇸 United States

Latest developments

  • CISA has confirmed active in-the-wild exploitation of a SolarWinds Serv-U denial-of-service flaw and added it to the KEV catalog. — BleepingComputer
  • The Serv-U flaw lets unauthenticated remote attackers crash servers via crafted POST requests exploiting uncontrolled resource consumption. — BleepingComputer
  • A patched Serv-U build is available; organizations can apply 15.5.4 Hotfix 1 to remediate the DoS flaw. — BleepingComputer
  • US federal civilian agencies are required to patch by June 19, 2026; private-sector organizations are urged to follow suit. — BleepingComputer
  • SolarWinds has advised blocking crafted POST requests as a workaround for organizations not yet able to apply the hotfix. — BleepingComputer
  • The size of the exposed Serv-U footprint is uncertain; scanning sources report estimates ranging from roughly 3,100 to over 12,000 servers. — BleepingComputer
  • It is not known what share of exposed Serv-U servers have applied the available fix. — BleepingComputer
  • No threat actor has been publicly identified as exploiting the flaw. — BleepingComputer

Timeline

Intelligence Refresh14 Jun 2026, 05:24
Corroboration13 Jun 2026, 23:42

CISA has confirmed that threat actors are actively exploiting a SolarWinds Serv-U vulnerability to crash servers. This represents a live cyber threat targeting enterprise infrastructure with potential denial-of-service and further intrusion implications for organizations running the affected software.

Source: r/cybersecurity (Social / Community) · View source

Status Change13 Jun 2026, 23:41

Status changed to developing

evidence_trigger: corroboration >= 2

signal -> developing

Corroboration13 Jun 2026, 23:41

CISA has added a SolarWinds Serv-U denial-of-service vulnerability (CVE-2026-28318) to its Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. The vulnerability affects SolarWinds Serv-U file transfer software, which is widely deployed across enterprises. For the London market, this represents a cyber threat requiring awareness among cyber underwriters monitoring systemic risk exposure across insured portfolios.

Source: r/cybersecurity (Social / Community) · View source

Intelligence Refresh11 Jun 2026, 21:10
Initial Detection5 Jun 2026, 20:24

Initial Detection

CISA has added CVE-2026-28318, a high-severity denial-of-service vulnerability in SolarWinds Serv-U file transfer software, to its Known Exploited Vulnerabilities Catalog following confirmed active exploitation. The flaw allows unauthenticated remote attackers to crash Serv-U servers via specially crafted POST requests, with over 12,000 Serv-U servers currently exposed online. Federal agencies have been ordered to patch by June 19, and private-sector organizations are urged to follow suit.

SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate. Remote attackers can exploit the security flaw without privileges in low-complexity attacks that don't require user interaction.

Source: BleepingComputer (Trade Media) · View source

Lloyd's classifications

Tracking this kind of risk? Get an email when Cyber events escalate.

Get alerts
← Back to live events