Critical SolarWinds Dameware Vulnerability Enables Attackers to Take Control of Remote Systems

SolarWinds has announced a critical command injection vulnerability in its Dameware software that could let authenticated attackers remotely compromise controlled hosts.

This vulnerability, identified as CVE-2026-28336, has a CVSS score of 9.9 and affects Dameware version 2026.3 and all earlier versions. To address this issue, SolarWinds has released version 2026.3.1, which organizations using the affected installations should prioritize updating.

The vendor published its advisory on November 3, 2026, crediting Greg Bernatowicz of the Boeing Enterprise Security Red Team with discovering the vulnerability.

According to the official security advisory, successful exploitation could allow remote control of the host. Authentication is explicitly required, distinguishing this issue from vulnerabilities that permit unauthenticated access.

SolarWinds Dameware Vulnerability

SolarWinds lists the vector CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. These metrics describe a network-accessible vulnerability with low attack complexity, low privileges required, and no user interaction.

The changed-scope designation indicates that exploitation can affect resources beyond the vulnerable security authority, while confidentiality, integrity, and availability impacts are each rated high.

The authentication requirement remains an important boundary: this is not a disclosed authentication bypass. Nevertheless, the low-privilege requirement means defenders should not assume that only highly privileged accounts could exploit it.

SolarWinds has not published the vulnerable parameter, command execution mechanism, exploit payload, or precise permissions needed beyond the scoring information.

The disclosure follows earlier coverage of a Dameware privilege escalation vulnerability involving incorrect permissions in the Mini Remote Control Service. That separate issue, CVE-2025-26396, required local access and was addressed in Dameware 12.3.2. Administrators should distinguish those historical fixes from the new command injection vulnerability and its required patched release.

Organizations should inventory Dameware deployments and upgrade affected installations to version 2026.3.1. As additional precautions, security teams should restrict remote administration access to trusted networks, review account privileges, and investigate unexpected commands or processes associated with remote support activity. These measures supplement patching rather than replace the vendor’s fix.

Related disclosures affecting SolarWinds Serv-U and Web Help Desk involved different products and vulnerability classes. Their patches do not remediate Dameware, underscoring the need to track each product’s version independently.

The Dameware advisory does not state that exploitation has occurred in the wild or provide indicators of compromise. Defenders should therefore avoid treating active exploitation as confirmed, while prioritizing remediation based on the vulnerability’s severity and potential host compromise.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.