EN PT-BR
← Voltar ao feed
high

SolarWinds Dameware 2026.3.1 fixes critical command injection CVE-2026-28336 (CVSS 9.9) and two other flaws; no exploitation reported

3 fonte(s) · 3 atualização(ões) · publicado 03/11/2026 21:00 · coletado há 14 horas

Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 3 fontes trouxeram em 07/11/2026 00:00; os links antigos trazem para cá.

Fontes: cert.cyber.gouv.fr ↗ securityonline.info ↗ gbhackers.com ↗

SolarWinds released Dameware 2026.3.1 on 3 November 2026 to fix a critical command injection vulnerability, CVE-2026-28336 (CVSS 9.9), that lets an authenticated, low-privileged attacker compromise a remotely controlled host (gbhackers.com, securityonline.info). The same release fixes two high-severity flaws: a buffer overflow enabling remote code execution, CVE-2026-28335 (CVSS 8.4), and a DLL hijacking flaw, CVE-2026-28327 (CVSS 8.2) (securityonline.info). CERT-FR relayed the advisories on 4 November in bulletin CERTFR-2026-AVI-1459, describing the impact as remote code execution and security policy bypass (cert.cyber.gouv.fr). No in-the-wild exploitation is reported: CISA's CVE record assessment lists exploitation as "none" (securityonline.info), and gbhackers.com and CERT-FR also report none. SolarWinds has not disclosed the vulnerable parameter, the exploitation mechanism or payload details (gbhackers.com, securityonline.info). Defenders should treat the upgrade as a priority given the low privilege threshold for the critical bug.

Entenda a falha

A vulnerabilidade

CVE-2026-28336 (CVSS 9.9) is a command injection in SolarWinds Dameware, the remote support tool. It is reachable over the network, needs low privileges and no user interaction, and can compromise the remotely controlled host. Authentication is required, but not a highly privileged account. CVE-2026-28335 (CVSS 8.4) is a buffer overflow that gives remote code execution to an authenticated attacker. CVE-2026-28327 (CVSS 8.2) is a DLL hijacking flaw that needs local access and admin privileges and only occurs during installation. Dameware 2026.3 and earlier are affected, and 2026.3.1 fixes all three. CERT-FR lists versions before 2026.3, but SolarWinds names 2026.3.1 as the fix, so treat 2026.3 as vulnerable. The release also updates Brotli (CVE-2026-111497), which SolarWinds says does not affect its on-premises products.

Como funciona

For CVE-2026-28336, an authenticated user with low privileges sends input to Dameware, and that input ends up being run as a command on the remotely controlled host. SolarWinds has not named the vulnerable feature or parameter, so the exact step where it goes wrong is unknown. For CVE-2026-28335, input handled by Dameware overflows a memory buffer, which can lead to code execution; the articles give no further detail. For CVE-2026-28327, the installer loads a DLL during installation, and a planted DLL could be loaded in its place and run with the installer's privileges.

Por que é vulnerável

CVE-2026-28336 is a command injection, meaning input is not properly handled before it reaches command execution. CVE-2026-28335 is a memory-safety bug (buffer overflow). CVE-2026-28327 belongs to the DLL hijacking class, where a library is loaded without making sure it comes from a trusted place. The articles do not explain why these went unnoticed or what exactly the fix changes.

Como foi descoberta

Greg Bernatowicz of the Boeing Enterprise Security Red Team reported the command injection and the buffer overflow, and Luiz Felipe Mol (Confu53) reported the DLL hijacking. SolarWinds published its advisories on 3 November 2026 with Dameware 2026.3.1, and CERT-FR relayed them on 4 November in bulletin CERTFR-2026-AVI-1459. The articles do not say how the researchers found the flaws. No exploitation in the wild is reported, and CISA's CVE record assessment lists exploitation as none.

Explicação gerada por IA a partir da matéria e dos artigos, em 07/11/2026 00:15.

Detalhes técnicos

  • CVE-2026-28336: command injection, CVSS vector CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. It is network-exploitable, with low complexity, low privileges, no user interaction and a changed scope. Confidentiality, integrity and availability impact are all high (gbhackers.com). It requires authentication, but not a highly privileged account.
  • CVE-2026-28335: buffer overflow leading to remote code execution for authenticated attackers (securityonline.info).
  • CVE-2026-28327: DLL hijacking rated CVSS 8.2 High (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H). It needs local access and admin privileges, and the hijack happens only during installation (cert.cyber.gouv.fr, securityonline.info).
  • Credits: Greg Bernatowicz of the Boeing Enterprise Security Red Team reported the command injection and buffer overflow flaws; Luiz Felipe Mol (Confu53) reported the DLL hijacking flaw (securityonline.info, gbhackers.com, cert.cyber.gouv.fr).
  • Third-party components: the release also updates Google Brotli (CVE-2026-111497) and Apache Log4net (CVE-2026-40021) (securityonline.info). CERT-FR describes CVE-2026-111497 as a Node.js Brotli decoder buffer overflow leading to remote code execution, rated 9.2 Critical, with a SolarWinds advisory dated 28 October 2026. SolarWinds says Dameware Remote Everywhere is not affected, lists no affected versions, and says its on-premises products do not use the vulnerable methods (cert.cyber.gouv.fr).
  • CVE-2026-28336 is separate from the earlier CVE-2025-26396, a local privilege escalation in the Dameware Mini Remote Control Service fixed in 12.3.2 (gbhackers.com).

Remediação

  • Inventory all Dameware deployments and upgrade to Dameware 2026.3.1, which fixes all three flaws (securityonline.info, gbhackers.com, cert.cyber.gouv.fr).
  • Until patched, restrict Dameware access to trusted administrator accounts and trusted networks, review account privileges, and monitor for unexpected commands or processes tied to remote support activity (securityonline.info, gbhackers.com).
  • Patches for other SolarWinds products such as Serv-U and Web Help Desk do not fix these Dameware flaws, so track each product separately (gbhackers.com).
  • For CVE-2026-111497, SolarWinds suggests blocking request bodies with "Content-Encoding: br" at a proxy, load balancer or WAF where relevant (cert.cyber.gouv.fr).

Relatos divergentes

  • Affected versions: securityonline.info and gbhackers.com say Dameware 2026.3 and all earlier versions are affected. CERT-FR (cert.cyber.gouv.fr) lists versions earlier than 2026.3, but notes that SolarWinds names 2026.3.1 as the fixed version for CVE-2026-28327, so 2026.3 itself should be treated as vulnerable. The vendor-based reading is the more authoritative one.
  • CVE-2026-111497 scope: securityonline.info presents the Brotli flaw as a bundled-library issue patched in this release. CERT-FR, relaying SolarWinds, says no versions are listed as affected and that on-premises products do not use the vulnerable methods. CERT-FR's account is later and closer to the vendor.
  • Review gap: CERT-FR states it did not review the SolarWinds advisories for CVE-2026-28335 and CVE-2026-28336, so its component mapping for those two is incomplete.

Linha do tempo

  1. cert.cyber.gouv.fr ↗ · pub. 03/11/2026 21:00 · coletado 06/11 12:00

    CERT-FR relays SolarWinds Dameware vulnerabilities allowing remote code execution and security bypass (CVE-2026-28327, -28335, -28336)

    ler a análise desta fonte

    CERT-FR bulletin CERTFR-2026-AVI-1459 relays SolarWinds advisories on multiple vulnerabilities in Dameware. It says they allow remote code execution and a security policy bypass. The bulletin lists Dameware versions earlier than 2026.3 as affected. It names CVE-2026-28327, CVE-2026-28335 and CVE-2026-28336 (advisories of 3 November 2026) and CVE-2026-111497 (advisory of 28 October 2026). SolarWinds states that Dameware Remote Everywhere is not affected by CVE-2026-111497. The bulletin does not report exploitation in the wild.

    Technical Details

    • CVE-2026-28327 is a DLL hijacking flaw rated CVSS 8.2 High (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H). It needs local access and admin privileges, and the hijack happens only during installation. It affects Dameware 2026.3 and all earlier versions. Luiz Felipe Mol (Confu53) is credited (solarwinds.com).
    • CVE-2026-111497 is a Node.js Brotli decoder buffer overflow leading to remote code execution, rated 9.2 Critical. SolarWinds lists no affected versions. It says its on-premises products do not use the vulnerable methods. As a mitigation it suggests blocking request bodies with "Content-Encoding: br" at a proxy, load balancer or WAF (solarwinds.com).
    • The bulletin does not map the other CVEs to components. The SolarWinds advisories for CVE-2026-28335 and CVE-2026-28336 were not reviewed.
    • SolarWinds names Dameware 2026.3.1 as the fixed version for CVE-2026-28327. This differs from the CERT-FR range, which says versions earlier than 2026.3 are affected (solarwinds.com).

    Remediation

    Update Dameware to the fixed release in the SolarWinds advisories, which is 2026.3.1 for CVE-2026-28327. Where relevant, apply the Brotli request-body mitigation.

  2. securityonline.info ↗ · pub. 03/11/2026 20:32 · coletado 04/11 08:52

    SolarWinds Patches Critical Dameware Command Injection Flaw CVE-2026-28336 (CVSS 9.9) Alongside Two Additional Bugs

    This article adds two additional vulnerabilities bundled in the same Dameware 2026.3.1 release: a high-severity buffer overflow (CVE-2026-28335, CVSS 8.4) enabling remote code execution for authenticated attackers, and a DLL hijacking flaw (CVE-2026-28327, CVSS 8.2) exploitable during installation with local admin access, credited to researcher Luiz Felipe Mol (Confu53). It also notes that the release patches two third-party library issues (Google Brotli CVE-2026-111497 and Apache Log4net CVE-2026-40021) and that CISA's CVE record assessment currently lists exploitation status as "none."

    ler a análise desta fonte

    This article adds two additional vulnerabilities bundled in the same Dameware 2026.3.1 release: a high-severity buffer overflow (CVE-2026-28335, CVSS 8.4) enabling remote code execution for authenticated attackers, and a DLL hijacking flaw (CVE-2026-28327, CVSS 8.2) exploitable during installation with local admin access, credited to researcher Luiz Felipe Mol (Confu53). It also notes that the release patches two third-party library issues (Google Brotli CVE-2026-111497 and Apache Log4net CVE-2026-40021) and that CISA's CVE record assessment currently lists exploitation status as "none."

    SolarWinds released Dameware 2026.3.1, fixing a critical command injection vulnerability (CVE-2026-28336, CVSS 9.9) that can lead to full compromise of a remotely controlled host, plus two high-severity flaws: a buffer overflow enabling remote code execution (CVE-2026-28335, CVSS 8.4) and a DLL hijacking issue exploitable during installation with local admin access (CVE-2026-28327, CVSS 8.2). The two most severe bugs require authentication. The update also patches two third-party library flaws bundled with Dameware. CISA's CVE record assessment currently lists exploitation as "none," and SolarWinds has not disclosed further technical detail on the vulnerable feature.

    Technical Details

    All Dameware versions up to and including 2026.3 are affected. CVE-2026-28336 and CVE-2026-28335 require authentication, limiting exploitation to authenticated attackers, while CVE-2026-28327 requires local machine access and admin privileges and occurs only during installation. Greg Bernatowicz of the Boeing Enterprise Security Red Team reported the command injection and buffer overflow bugs, while Luiz Felipe Mol (Confu53) discovered the DLL hijacking flaw. The release also updates the bundled Google Brotli library (CVE-2026-111497) and Apache Log4net (CVE-2026-40021).

    Remediation

    Upgrade to Dameware 2026.3.1 to remediate all three flaws. Until patched, organizations should restrict Dameware access to trusted administrator accounts.

  3. gbhackers.com ↗ · pub. 04/11/2026 02:06 · coletado 04/11 03:00 primeiro registro

    Critical Command Injection Flaw in SolarWinds Dameware (CVE-2026-28336, CVSS 9.9) Patched

    ler a análise desta fonte

    SolarWinds disclosed a critical command injection vulnerability in its Dameware remote administration software, tracked as CVE-2026-28336 with a CVSS score of 9.9. The flaw affects Dameware version 2026.3 and all prior releases, allowing authenticated attackers with low privileges to remotely compromise controlled hosts. The vendor published the advisory on November 3, 2026, crediting Greg Bernatowicz of the Boeing Enterprise Security Red Team for the discovery, and released a fixed version, 2026.3.1. SolarWinds has not disclosed the vulnerable parameter, exploitation mechanism, or payload details, and there is no evidence of in-the-wild exploitation at this time.

    Technical Details

    The CVSS vector CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H indicates a network-exploitable vulnerability with low attack complexity, low privileges required, no user interaction, and a changed scope — meaning impact can extend beyond the vulnerable component. Confidentiality, integrity, and availability are all rated high. Although authentication is required (distinguishing it from an unauthenticated bypass), the low-privilege threshold means attackers do not need highly privileged accounts to exploit it. This is a separate issue from the previously disclosed CVE-2025-26396, a local privilege escalation flaw in the Dameware Mini Remote Control Service fixed in version 12.3.2.

    Remediation

    Organizations should inventory all Dameware deployments and upgrade to version 2026.3.1 as a priority. Additional mitigations include restricting remote administration access to trusted networks, reviewing account privileges, and monitoring for unexpected commands or processes tied to remote support activity. Patches for other SolarWinds products, such as Serv-U and Web Help Desk, do not remediate this Dameware vulnerability, so each product's patch status should be tracked independently.