CERT-FR relays SolarWinds Dameware vulnerabilities allowing remote code execution and security bypass (CVE-2026-28327, -28335, -28336)
CERT-FR bulletin CERTFR-2026-AVI-1459 relays SolarWinds advisories on multiple vulnerabilities in Dameware. It says they allow remote code execution and a security policy bypass. The bulletin lists Dameware versions earlier than 2026.3 as affected. It names CVE-2026-28327, CVE-2026-28335 and CVE-2026-28336 (advisories of 3 November 2026) and CVE-2026-111497 (advisory of 28 October 2026). SolarWinds states that Dameware Remote Everywhere is not affected by CVE-2026-111497. The bulletin does not report exploitation in the wild.
Entenda a falha
A vulnerabilidade
CERT-FR bulletin CERTFR-2026-AVI-1459 relays SolarWinds advisories for several Dameware flaws, with remote code execution and security policy bypass as the impacts. Most severe is CVE-2026-111497, a Node.js Brotli decoder buffer overflow leading to RCE, rated 9.2 Critical. SolarWinds lists no affected versions, says its on-premises products do not use the vulnerable methods, and says Dameware Remote Everywhere is not affected. CVE-2026-28327 is a DLL hijacking flaw (CVSS 8.2 High) that needs local access and admin privileges and works only during installation. It affects Dameware 2026.3 and earlier, with 2026.3.1 as the fix. The bulletin does not map CVE-2026-28335 and CVE-2026-28336 to components. CERT-FR says versions before 2026.3 are affected, which differs from SolarWinds.
Como funciona
For CVE-2026-111497, an HTTP request body marked with the Content-Encoding value br is passed to the Node.js Brotli decoder. The decoder handles the compressed data, and at that step a buffer overflow can occur, which can lead to code execution. The articles give no more detail on the internal steps. For CVE-2026-28327, the Dameware installer loads a DLL while it runs, and a planted DLL could be loaded in its place. The code then runs with the installer's privileges. The articles do not explain the mechanism of the other two CVEs.
Por que é vulnerável
For CVE-2026-111497 the root cause is a memory-safety bug (buffer overflow) in the Node.js Brotli decoder. For CVE-2026-28327 the weakness is the DLL hijacking class: the installer loads a library without making sure it comes from a trusted place. The articles do not say why these went unnoticed or what exactly the fix changes, and they give no cause for CVE-2026-28335 and CVE-2026-28336.
Como foi descoberta
SolarWinds credits Luiz Felipe Mol (Confu53) for CVE-2026-28327. The articles do not say how the other CVEs were found. SolarWinds published its advisory for CVE-2026-111497 on 28 October 2026 and those for CVE-2026-28327, -28335 and -28336 on 3 November 2026. CERT-FR relayed them on 4 November 2026. The bulletin does not report exploitation in the wild.
Explicação gerada por IA a partir da matéria e dos artigos, em 06/11/2026 12:26.
Detalhes técnicos
- CVE-2026-28327 is a DLL hijacking flaw rated CVSS 8.2 High (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H). It needs local access and admin privileges, and the hijack happens only during installation. It affects Dameware 2026.3 and all earlier versions. Luiz Felipe Mol (Confu53) is credited (solarwinds.com).
- CVE-2026-111497 is a Node.js Brotli decoder buffer overflow leading to remote code execution, rated 9.2 Critical. SolarWinds lists no affected versions. It says its on-premises products do not use the vulnerable methods. As a mitigation it suggests blocking request bodies with "Content-Encoding: br" at a proxy, load balancer or WAF (solarwinds.com).
- The bulletin does not map the other CVEs to components. The SolarWinds advisories for CVE-2026-28335 and CVE-2026-28336 were not reviewed.
- SolarWinds names Dameware 2026.3.1 as the fixed version for CVE-2026-28327. This differs from the CERT-FR range, which says versions earlier than 2026.3 are affected (solarwinds.com).
Remediação
Update Dameware to the fixed release in the SolarWinds advisories, which is 2026.3.1 for CVE-2026-28327. Where relevant, apply the Brotli request-body mitigation.
Linha do tempo
-
CERT-FR relays SolarWinds Dameware vulnerabilities allowing remote code execution and security bypass (CVE-2026-28327, -28335, -28336)
ler a análise desta fonte ocultar
CERT-FR bulletin CERTFR-2026-AVI-1459 relays SolarWinds advisories on multiple vulnerabilities in Dameware. It says they allow remote code execution and a security policy bypass. The bulletin lists Dameware versions earlier than 2026.3 as affected. It names CVE-2026-28327, CVE-2026-28335 and CVE-2026-28336 (advisories of 3 November 2026) and CVE-2026-111497 (advisory of 28 October 2026). SolarWinds states that Dameware Remote Everywhere is not affected by CVE-2026-111497. The bulletin does not report exploitation in the wild.
Technical Details
- CVE-2026-28327 is a DLL hijacking flaw rated CVSS 8.2 High (CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H). It needs local access and admin privileges, and the hijack happens only during installation. It affects Dameware 2026.3 and all earlier versions. Luiz Felipe Mol (Confu53) is credited (solarwinds.com).
- CVE-2026-111497 is a Node.js Brotli decoder buffer overflow leading to remote code execution, rated 9.2 Critical. SolarWinds lists no affected versions. It says its on-premises products do not use the vulnerable methods. As a mitigation it suggests blocking request bodies with "Content-Encoding: br" at a proxy, load balancer or WAF (solarwinds.com).
- The bulletin does not map the other CVEs to components. The SolarWinds advisories for CVE-2026-28335 and CVE-2026-28336 were not reviewed.
- SolarWinds names Dameware 2026.3.1 as the fixed version for CVE-2026-28327. This differs from the CERT-FR range, which says versions earlier than 2026.3 are affected (solarwinds.com).
Remediation
Update Dameware to the fixed release in the SolarWinds advisories, which is 2026.3.1 for CVE-2026-28327. Where relevant, apply the Brotli request-body mitigation.