CISA: Hackers now exploit SolarWinds Serv-U flaw to crash servers

Hackers exploit CVE-2026-28318 flaw in SolarWinds Serv-U to crash servers. The vulnerability allows remote attackers to trigger denial-of-service via specially crafted POST requests without authentication. SolarWinds released Serv-U 15.5.4 Hotfix 1 to patch the issue. CISA added the flaw to its Known Exploited Vulnerabilities Catalog and mandated federal agencies to patch by June 19 under BOD 22-01. Shodan tracks 12,000 exposed Serv-U servers, Shadowserver tracks 3,100.