Washington orders urgent patch for exploited SolarWinds flaw
PUBLISHED Jun 8, 2026, 1:30 PM ET
Read, Watch or Listen
Washington, D.C., The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency directive ordering all federal civilian agencies to urgently mitigate a high-severity vulnerability in SolarWinds Serv-U file transfer software, tracked as CVE-2026-28318. SolarWinds disclosed the flaw on June 3, 2026, describing it as an uncontrolled resource consumption issue that can be exploited remotely and without authentication. Attackers can send specially crafted HTTP POST requests that abuse the “Content-Encoding: deflate” header, forcing the affected server to consume excessive resources until it crashes, resulting in a complete denial-of-service condition and making file transfer services unavailable to legitimate users. Washington, D.C., CISA’s directive requires agencies to install the Serv-U 15.5.4 Hotfix 1 or apply documented mitigations no later than June 19, 2026, emphasizing that the vulnerability is already under active exploitation in the wild. The agency said the simplicity of the attack method and the critical role of file transfer servers in government and enterprise environments significantly increase the risk posed by the flaw. Security experts have warned that the public availability of the exploit technique heightens the urgency for organizations to act and have advised those unable to patch immediately to restrict access to the Serv-U interface and use web application firewalls to disable the vulnerable Content-Encoding functionality.
By Lauren Mitchell | JQJO News
Timeline of Events
- June 3, 2026 SolarWinds publicly discloses Serv-U vulnerability
- June 3, 2026 Vendor releases Serv-U 15.5.4 hotfix
- Early June 2026 Exploit observed actively used in-the-wild
- Early June 2026 Researchers detail uncontrolled resource consumption weakness
- Today CISA issues emergency directive to agencies
- By June 19, 2026 Agencies must patch or mitigate systems
- June 2026 Experts urge restricting Serv-U external access
- June 2026 Administrators advised disabling deflate header functionality
News Intelligence
- This SolarWinds flaw puts your data at risk. If you work in a federal agency, your files could be inaccessible. If you're a citizen, government services might slow down. Check if your workplace uses SolarWinds. Ask about their patch plan.
Comments