A Crash, Not a Shell: SolarWinds Serv-U CVE-2026-28318

TL;DR:
SolarWinds Serv-U 15.5.4 and earlier can be killed by a single unauthenticated request: a POST request carrying Content-Encoding: deflate and any body crashes the service. Underneath the crash is real heap corruption, the kind that sometimes turns a “denial of service” into remote code execution, so we spent the time to find out. The bottom line: it does not, on the builds we analyzed. We chased three separate roads to RCE and proved each one is a dead end, which means the honest impact is exactly what SolarWinds rated it, an availability-only DoS (CVSS 7.5). Patch to Serv-U 15.5.4 HF1, or if you cannot patch yet, block POST requests that carry a Content-Encoding header at your WAF. We are releasing a CVE-2026-28318-check">safe detection tool that flags vulnerable hosts without crashing them.…