SolarWinds published an advisory on 3 November 2026 for CVE-2026-28336, a command injection vulnerability in SolarWinds Dameware, its remote-support and remote-control product. SolarWinds rates it Critical with a CVSS score of 9.9. Authentication is required: an attacker needs a valid low-privileged account before the flaw can be used. SolarWinds says the flaw "could lead to the compromise of the remotely controlled host," so the risk reaches the machines Dameware manages. The fix is Dameware 2026.3.1.
Technical Information
SolarWinds describes CVE-2026-28336 as a command injection vulnerability that "could lead to the compromise of the remotely controlled host," and states that "authentication is required."
The advisory page shows the vector as CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, and SolarWinds' CVE record lists the same metrics under CVSS 3.1, with the same 9.9 score. In plain terms: it can be reached over the network, attack complexity is low, low privileges are required, no user interaction is needed, and scope is changed. In our reading, changed scope fits the advisory's wording: impact reaches beyond the vulnerable component to the host being remotely controlled, with high impact to confidentiality, integrity and availability.
The advisory does not name the affected Dameware component, and it does not describe the injection point. It also does not report exploitation in the wild, and CISA's enrichment of the CVE record lists exploitation as "none." As of 4 November 2026, CVE-2026-28336 is not in CISA's Known Exploited Vulnerabilities catalog. We found no public proof of concept in the sources we reviewed. SolarWinds credits Greg Bernatowicz of the Boeing Enterprise Security Red Team with the discovery.
Affected Product Versions
- Affected: SolarWinds Dameware 2026.3 and all previous versions
- Fixed: SolarWinds Dameware 2026.3.1
The Dameware 2026.3.1 release notes list two more Dameware fixes in the same release: CVE-2026-28335, a buffer overflow rated 8.4 High that also requires authentication, and CVE-2026-28327, a DLL hijacking issue rated 8.2 High that occurs during installation and requires local admin access.
Workaround and Mitigation
- Upgrade to Dameware 2026.3.1. This is the only remediation SolarWinds lists, and it recommends upgrading "as soon as is practical." The advisory gives no interim workaround.
The steps below are Rescana guidance, not SolarWinds guidance, for the period until you have patched:
- Limit who holds Dameware accounts. The flaw requires authentication, so check every Dameware account, remove stale or shared ones, and enforce strong authentication wherever your deployment supports it.
- Limit network reach. Keep Dameware services off the internet, and allow access only from admin networks or a VPN.
- Watch remote sessions. Review Dameware session and account activity, especially sessions started by low-privileged or unexpected accounts.
Indicators of Compromise
SolarWinds has published no indicators of compromise, and we know of no public IoCs for CVE-2026-28336. We will not list speculative indicators. If you suspect misuse, our general guidance is to start with unexpected command execution or new processes on hosts that Dameware sessions have touched, and with Dameware logins from unusual accounts or sources.
What to do with this vendor today (TPRM)
Dameware is remote-support software. Wherever it runs, it has strong, direct access into the machines it manages. That means your exposure may sit with a managed service provider or IT outsourcer that supports your endpoints, not only in your own environment. Ask those suppliers today:
- Do you use SolarWinds Dameware to support our systems or users?
- If so, are all instances on 2026.3.1, and when was the upgrade completed?
- How do you control and review Dameware accounts (named accounts, MFA where supported, removing leavers)?
- Is Dameware access restricted to admin networks or a VPN, and never exposed to the internet?
- Will you tell us if you find any unexplained Dameware session or command activity on hosts that serve us?
Our platform validates vendor claims against live attack-surface signal and chases findings to closure under your approval.
Need help working through remote-support and MSP suppliers exposed to CVE-2026-28336? Our team can help you prioritize them and track their answers. Talk to an expert
Sources
- SolarWinds Security Advisory, CVE-2026-28336: https://www.solarwinds.com/trust-center/security-advisories/cve-2026-28336
- SolarWinds Dameware 2026.3.1 release notes: https://documentation.solarwinds.com/en/success_center/dameware/content/release_notes/dameware_2026-3-1_release_notes.htm
- CVE record, CVE-2026-28336: https://www.cve.org/CVERecord?id=CVE-2026-28336
- NVD, CVE-2026-28336: https://nvd.nist.gov/vuln/detail/CVE-2026-28336
- KEV status, checked 4 Nov 2026: CVE-2026-28336 is not in CISA's Known Exploited Vulnerabilities Catalog (catalog version 2026.11.03). Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
