Critical Command Injection Flaw in SolarWinds Dameware (CVE-2026-28336, CVSS 9.9) Patched
SolarWinds disclosed a critical command injection vulnerability in its Dameware remote administration software, tracked as CVE-2026-28336 with a CVSS score of 9.9. The flaw affects Dameware version 2026.3 and all prior releases, allowing authenticated attackers with low privileges to remotely compromise controlled hosts. The vendor published the advisory on November 3, 2026, crediting Greg Bernatowicz of the Boeing Enterprise Security Red Team for the discovery, and released a fixed version, 2026.3.1. SolarWinds has not disclosed the vulnerable parameter, exploitation mechanism, or payload details, and there is no evidence of in-the-wild exploitation at this time.
Entenda a falha
A vulnerabilidade
CVE-2026-28336 (CVSS 9.9) is a command injection flaw in SolarWinds Dameware remote administration software. It affects Dameware 2026.3 and all earlier versions; version 2026.3.1 fixes it. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C) means an attacker needs network reach and a low-privilege authenticated account, with no user interaction. Successful exploitation could let them remotely compromise the controlled hosts, with high impact on confidentiality, integrity and availability. It is not an authentication bypass, and it is separate from CVE-2025-26396, an older local privilege escalation fixed in 12.3.2.
Como funciona
The articles do not describe the internal flow. They say only that an authenticated user with low privileges, reaching Dameware over the network, can get commands executed that lead to control of the host. SolarWinds has not published the vulnerable parameter or the command execution mechanism, so the exact step where input becomes a command is not public.
Por que é vulnerável
The flaw is classified as command injection, which generally means input is passed into a command without proper neutralization. The articles do not confirm the specific root cause, the reason it went unnoticed, or what exactly the fix in 2026.3.1 changes.
Como foi descoberta
SolarWinds published its advisory on November 3, 2026, crediting Greg Bernatowicz of the Boeing Enterprise Security Red Team with the discovery. The articles do not say how it was found or reported. The advisory does not state that exploitation has occurred in the wild and gives no indicators of compromise.
Explicação gerada por IA a partir da matéria e dos artigos, em 04/11/2026 03:16.
Detalhes técnicos
The CVSS vector CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H indicates a network-exploitable vulnerability with low attack complexity, low privileges required, no user interaction, and a changed scope — meaning impact can extend beyond the vulnerable component. Confidentiality, integrity, and availability are all rated high. Although authentication is required (distinguishing it from an unauthenticated bypass), the low-privilege threshold means attackers do not need highly privileged accounts to exploit it. This is a separate issue from the previously disclosed CVE-2025-26396, a local privilege escalation flaw in the Dameware Mini Remote Control Service fixed in version 12.3.2.
Remediação
Organizations should inventory all Dameware deployments and upgrade to version 2026.3.1 as a priority. Additional mitigations include restricting remote administration access to trusted networks, reviewing account privileges, and monitoring for unexpected commands or processes tied to remote support activity. Patches for other SolarWinds products, such as Serv-U and Web Help Desk, do not remediate this Dameware vulnerability, so each product's patch status should be tracked independently.
Linha do tempo
-
Critical Command Injection Flaw in SolarWinds Dameware (CVE-2026-28336, CVSS 9.9) Patched
ler a análise desta fonte ocultar
SolarWinds disclosed a critical command injection vulnerability in its Dameware remote administration software, tracked as CVE-2026-28336 with a CVSS score of 9.9. The flaw affects Dameware version 2026.3 and all prior releases, allowing authenticated attackers with low privileges to remotely compromise controlled hosts. The vendor published the advisory on November 3, 2026, crediting Greg Bernatowicz of the Boeing Enterprise Security Red Team for the discovery, and released a fixed version, 2026.3.1. SolarWinds has not disclosed the vulnerable parameter, exploitation mechanism, or payload details, and there is no evidence of in-the-wild exploitation at this time.
Technical Details
The CVSS vector CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H indicates a network-exploitable vulnerability with low attack complexity, low privileges required, no user interaction, and a changed scope — meaning impact can extend beyond the vulnerable component. Confidentiality, integrity, and availability are all rated high. Although authentication is required (distinguishing it from an unauthenticated bypass), the low-privilege threshold means attackers do not need highly privileged accounts to exploit it. This is a separate issue from the previously disclosed CVE-2025-26396, a local privilege escalation flaw in the Dameware Mini Remote Control Service fixed in version 12.3.2.
Remediation
Organizations should inventory all Dameware deployments and upgrade to version 2026.3.1 as a priority. Additional mitigations include restricting remote administration access to trusted networks, reviewing account privileges, and monitoring for unexpected commands or processes tied to remote support activity. Patches for other SolarWinds products, such as Serv-U and Web Help Desk, do not remediate this Dameware vulnerability, so each product's patch status should be tracked independently.