VULNpocalypse
CriticalVulnerabilityPatch available

SolarWinds Dameware CVE-2026-28336 command injection, fixed in 2026.3.1

SolarWinds fixed a critical authenticated command injection flaw, CVE-2026-28336, in Dameware 2026.3 and earlier, upgrade to Dameware 2026.3.1.

Published
Fixed in
SolarWinds Dameware 2026.3.1
Exploitation
No, the vendor advisory does not report attacks in the wild, according to Cyber Security News

Live scores

CVE-2026-28336
EPSS
0.016
some chance of attack soon
VEDAS
0.515
likely exploited
On CISA KEV
Not listed
Detection rule
No public rule yet

What happened

SolarWinds published a security advisory on November 3, 2026 for a command injection vulnerability in its Dameware remote support software. The flaw is tracked as CVE-2026-28336. The vendor says the flaw “could lead to the compromise of the remotely controlled host” and that authentication is required (SolarWinds).

SolarWinds rates the issue 9.9 Critical with the vector CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (SolarWinds). Cyber Security News explains what the vector means:

  • The flaw can be used over a network with low complexity.
  • It needs low privileges and no user interaction.
  • Its impact changes scope, so it can reach beyond the vulnerable component to the remote machine.

The vendor credits Greg Bernatowicz of the Boeing Enterprise Security Red Team with the finding (SolarWinds). Cyber Security News reports that no malware is tied to the flaw and that the advisory does not report attacks in the wild (Cyber Security News). The Belgian national CERT also issued a warning about the flaw, headlined “Critical Command Injection Vulnerability in SolarWinds Dameware, Patch Immediately!” (CERT-BE).

The sources do not identify the exact vulnerable component and input: not confirmed.

Am I affected?

  • You are affected if you run SolarWinds Dameware 2026.3 or any earlier version (SolarWinds).
  • Dameware 2026.3.1 is the fixed release (SolarWinds).
  • An attacker must be authenticated before they can exploit the flaw (SolarWinds).

What to do now

  1. Upgrade every Dameware installation to 2026.3.1 (SolarWinds).
  2. Review who holds Dameware accounts and remove any accounts that are not needed, as advised by Cyber Security News.
  3. Limit network access to the Dameware tool, as advised by Cyber Security News.
  4. Watch Dameware logs for unexpected commands, as advised by Cyber Security News. Specific indicators of compromise: not confirmed.

Sources