Critical SolarWinds Dameware Flaw Could Allow Attackers to Compromise Remote Systems

SolarWinds has warned about a critical command injection flaw in its Dameware remote support software. It is tracked as CVE-2026-28336 and carries a severity score of 9.9 out of 10.

The bug could let an attacker take over a computer that an IT team is controlling remotely. Dameware is widely used by help desks and administrators to connect to and fix remote computers.

Since the tool runs with strong access, a flaw in it is risky for any company that depends on it. SolarWinds published the advisory on November 3, 2026, and urged users to update quickly.

Analysts at SolarWinds noted the problem in their security advisory. No malware is tied to this flaw, and the advisory does not report any attacks in the wild.

It says the issue could lead to the compromise of the remotely controlled host. This is not the first Dameware bug to draw attention, since an earlier Dameware privilege escalation flaw was fixed in 2025.

Critical SolarWinds Dameware Flaw Could Allow Attackers

Command injection happens when software accepts input from a user and passes it to the system without checking it properly. An attacker can then slip in their own commands.

In this case, the attacker must already be logged in, so the flaw needs valid access first. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) shows the flaw can be used over a network with low complexity.

It needs only low privileges and no user interaction. It also changes scope, which means the impact can spread beyond the weak component to the remote machine. Confidentiality, integrity and availability are all rated high.

The issue affects SolarWinds Dameware 2026.3 and all earlier versions. The fixed release is Dameware 2026.3.1. Greg Bernatowicz of the Boeing Enterprise Security Red Team received credit for finding it, according to the official SolarWinds advisory.

Why SolarWinds Users Should Act Fast

Attackers like remote support tools because one stolen login can open many systems. Recent history shows how quickly SolarWinds bugs get abused. Hackers were seen exploiting Web Help Desk flaws to install extra remote access tools.

SolarWinds has been patching many products this year. Recent updates covered critical SolarWinds Observability flaws that allowed remote code execution.

The company also released Serv-U security fixes for 15 vulnerabilities in July. Administrators should upgrade Dameware to 2026.3.1 now, review who holds Dameware accounts, and remove any that are not needed. They should also limit network access to the tool and watch logs for strange commands.

Indicators of compromise (IoCs):-

Field	Detail
CVE ID	CVE-2026-28336
Product	SolarWinds Dameware
Flaw type	Command injection
Severity	9.9 Critical
CVSS vector	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected versions	2026.3 and all earlier versions
Fixed version	2026.3.1
Authentication	Required
Published	November 3, 2026
Credited researcher	Greg Bernatowicz, Boeing Enterprise Security Red Team

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.