SolarWinds Serv-U Vulnerability Still Active: What Small Business Owners Must Do Now
Two months after CISA added it to the Known Exploited Vulnerabilities catalog, CVE-2026-28318 remains a live threat to small businesses running SolarWinds Serv-U. This isn't a theoretical risk. The vulnerability allows attackers to crash your file transfer service without needing any credentials—just a specially crafted POST request. If you haven't patched or mitigated this yet, your service is likely still vulnerable right now.
What Actually Happens When This Vulnerability Gets Exploited
SolarWinds Serv-U is a file transfer application many small businesses use for secure data exchange. The vulnerability is straightforward: if an attacker sends a POST request with a Content-Encoding: deflate header, the service consumes resources uncontrollably and crashes. No authentication required. No advanced techniques needed. Your Serv-U instance simply stops working.
The real problem isn't the technical detail—it's the business impact. Your team can't transfer files. Partners can't access shared folders. Depending on your workflow, this could mean lost revenue, delayed projects, or angry clients. And since the patch deadline of June 19, 2026 has already passed, any organization still running unpatched Serv-U is operating on borrowed time.
Why Detection Matters More Than You Think
Most small business owners assume their Serv-U instance is fine because nothing has obviously broken. That's the detection-and-ownership gap at work. You probably don't monitor every inbound request to your file transfer server. You might not even know which systems in your network are running Serv-U. An attacker could be testing your instance right now, preparing for a crash at the worst possible moment, and you'd have no visibility into it.
The CISA Known Exploited Vulnerabilities catalog lists this because attacks are happening in the wild. This isn't a hypothetical exercise.
Three Action Steps You Need to Take This Week
Step 1: Identify Every Instance of Serv-U You Own
Don't assume you know where Serv-U is deployed. Check your documentation, ask your IT person or managed service provider, and scan your network if necessary. Small businesses often discover forgotten legacy systems this way. List every instance with its version number.
Step 2: Apply the Vendor Patch or Implement Mitigations Immediately
SolarWinds has released patches for affected versions. Download and test them in a non-production environment first, then deploy to all instances. If you cannot patch for technical reasons, SolarWinds has published mitigation guidance—follow it exactly. If neither option is available for your version, you're in the discontinuation zone, and you need to plan a migration off Serv-U.
Step 3: Document Your Compliance and Monitor Going Forward
Once patched or mitigated, document the date and version applied. If you're subject to BOD 22-01 compliance (federal contractors and cloud service providers), follow those specific guidance requirements. Set a calendar reminder to review SolarWinds advisories quarterly—vulnerability chasing never stops.