SolarWinds Dameware Command Injection Flaw CVE-2026-28336 (CVSS 9.9) Patched

TL;DR

SolarWinds has fixed CVE-2026-28336, a critical Dameware command injection flaw rated CVSS 9.9. The bug can lead to “the compromise of the remotely controlled host,” according to the vendor. Dameware 2026.3.1 also patches two high-severity bugs and two third-party library flaws.

Dameware 2026.3 and earlier contain a command injection bug, a buffer overflow and a DLL hijacking flaw. The two most serious bugs require authentication. Upgrade to SolarWinds Dameware 2026.3.1.

Why It Matters

Dameware is a remote support tool that IT teams use to control desktops and servers. As a result, a flaw in it can hand an attacker the very machines admins manage. Greg Bernatowicz of the Boeing Enterprise Security Red Team reported the command injection and buffer overflow bugs. Meanwhile, Luiz Felipe Mol (Confu53) found the DLL hijacking flaw.

So far, no exploitation in the wild has been confirmed. CISA’s assessment in the CVE records lists exploitation as “none.”

How the Attack Works

CVE-2026-28336: command injection (CVSS 9.9)

The advisory says the flaw “could lead to the compromise of the remotely controlled host.” However, “Authentication is required.” SolarWinds has not published further technical detail, so the vulnerable feature remains unnamed.

CVE-2026-28335: buffer overflow (CVSS 8.4)

This bug “can result in remote code execution,” SolarWinds says. It also requires authentication.

CVE-2026-28327: DLL hijacking (CVSS 8.2)

This flaw “occurs during installations only and requires access to the local machine and admin privileges.”

Affected Versions

All Dameware versions up to and including 2026.3 are affected, per the CVE records.

Patch and Mitigation

Install Dameware 2026.3.1 to close this Dameware command injection flaw. The release also updates Google Brotli (CVE-2026-111497) and Apache Log4net (CVE-2026-40021). Until you patch, limit Dameware access to trusted admin accounts.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.