SolarWinds patches critical command injection flaw in Dameware
SolarWinds disclosed a critical command injection vulnerability in Dameware (CVE-2026-28336), scoring CVSS 9.9, allowing authenticated attackers with low privileges to execute commands and potentially take over remotely managed systems. According to the advisory, there is no public exploit and no confirmed in-the-wild attacks. A fix is available in version 2026.3.1 and SolarWinds recommends upgrading.
What happened
SolarWinds disclosed a critical flaw (CVSS 9.9) in Dameware, its remote administration software. An authenticated attacker with low privileges can execute commands and potentially take control of managed systems. A fix is already available in version 2026.3.1.
Why it matters
Dameware administers servers and workstations in enterprise environments. Successful exploitation could put sensitive systems and the data they handle at risk, according to the advisory. Exploitation requires an authenticated attacker, which reduces but does not eliminate the risk.
What to do
Upgrade Dameware to version 2026.3.1. Review who holds Dameware accounts, including low-privileged ones, and monitor for unusual commands and sessions.
For the technical team
- CVE
- CVE-2026-28336
- Affected
- SolarWinds Dameware (software de administração remota) · SolarWinds Dameware 2026.3 and earlier.
- Exploitation
- No public exploit identified and no confirmed in-the-wild attacks, according to the advisory relayed by DarkWebInformer.
- Fix
- Upgrade to Dameware 2026.3.1, the fixed version, as recommended by SolarWinds.
- Vector
- Command injection in Dameware, remote administration software. Network attack vector, requires an authenticated attacker with low privileges, no user interaction.
- More details
- CVSS 9.9. Reported impact: potential compromise of remotely controlled hosts. Source: SolarWinds advisory relayed via DarkWebInformer.
Timeline
SolarWinds publishes the advisory for CVE-2026-28336 in Dameware.
Sources 1 source
- @DarkWebInformer @DarkWebInformer
