SolarWinds Serv-U EUVD-2026-34268

The target Serv-U instance must expose its HTTP or HTTPS interface to the attacker's network path and be running a Serv-U version prior to 15.5.4 Hotfix 1; the attacker must be able to send a POST request carrying the Content-Encoding: deflate header to that interface. No authentication, no user interaction, and no special server configuration are required (CVSS PR:N/UI:N), so default Serv-U deployments reachable from the attacker are exploitable. Limiting factors: exploitation is bounded to availability impact (service crash) with no code execution or data disclosure, and exposure depends on whether Serv-U's web/management endpoints are reachable - internet-facing or DMZ deployments are the realistic targets, while installations behind tight IP allow-lists or VPN-only access materially reduce reachability.

Signals are moderate and consistent: the CVSS 7.5 reflects network-reachable, low-complexity, no-privileges, no-user-interaction exploitation with high availability impact (C:N/I:N/A:H), and CWE-400 makes a crash trivial to trigger once the payload is known. There is no CISA KEV listing, no published POC referenced in the provided data, and EPSS was not supplied - so this should be treated as 'no public exploit identified at time of analysis' rather than zero-day. Operationally, Serv-U is often internet-exposed for file transfer, so the realistic risk is targeted DoS against business-critical transfer flows; this is a real-availability priority for organizations exposing Serv-U to untrusted networks, but not a code-execution emergency.

An attacker on the internet sends a single crafted HTTP POST with a Content-Encoding: deflate header and a malformed or oversized compressed body to an exposed Serv-U HTTP/HTTPS listener, causing the Serv-U service process to crash and interrupting all in-flight file transfers and management sessions. Because no authentication or user interaction is required, the request can be scripted and repeated to keep the service offline whenever it restarts; no public exploit is identified at time of analysis, but the trigger is described in plain text in the advisory.