SolarWinds Dameware CVE-2026-28336 Explained: Critical 9.9 Flaw Lets Logged-In Attackers Take Over Remote PCs — Update to 2026.3.1

Illustrative image: an IT help desk — Dameware is the remote-support tool help desks use to control PCs and servers. This is not a Dameware screenshot; the flaw is in software, and SolarWinds' advisory carries no product photo. Image: Wikimedia Commons / Teaching and Learning with Technology, Penn State, CC BY.

TL;DR — SolarWinds Dameware CVE-2026-28336 explained in one line: a critical command-injection flaw rated 9.9 out of 10 lets a logged-in attacker with only low privileges run commands on a remotely controlled PC — Dameware 2026.3 and all earlier versions are affected, and the fix is Dameware 2026.3.1, released 3 November 2026.

📌 KEY HIGHLIGHTS

• The flaw: CVE-2026-28336, a command-injection vulnerability (CWE-20, improper input validation) in SolarWinds Dameware, scored 9.9 Critical on CVSS 3.0.
• The impact: SolarWinds says successful exploitation "could lead to the compromise of the remotely controlled host" — the machine the IT team is supporting.
• The catch: authentication is required, but only low privileges — no user interaction, and the attack works over the network.
• Affected versions: Dameware 2026.3 and all earlier versions. Fixed in Dameware 2026.3.1, released 3 November 2026.
• Exploitation: none confirmed — SolarWinds reports no attacks in the wild, and CISA's assessment in the CVE records lists exploitation as "none". Patch now anyway; a 9.9 with a public advisory does not stay unexploited for long.

SolarWinds Dameware CVE-2026-28336 explained: what happened

SolarWinds published its security advisory on 3 November 2026. Dameware, the company's remote-support software that IT teams and help desks use to take control of desktops and servers and fix them from afar, contains a command-injection flaw. The flaw is tracked as CVE-2026-28336 and carries a CVSS 3.0 score of 9.9 — one step below the maximum 10.

The score's vector tells the story in shorthand: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Network-accessible, low attack complexity, low privileges required, no user interaction needed, and "changed scope" — meaning the damage can spread beyond the vulnerable component to the machine being controlled. Confidentiality, integrity and availability impacts are each rated high.

The flaw was reported by Greg Bernatowicz of the Boeing Enterprise Security Red Team, whom SolarWinds credits in the advisory. Dameware 2026.3.1, released the same day as the advisory, closes it. SolarWinds has not published the vulnerable parameter, the command-execution mechanism, or the exact feature involved, so this post does not speculate about them — the practical facts (what is affected, what to install) are all confirmed.

How the flaw works — and the two other bugs fixed in the same release

Command injection happens when software takes input from a user and passes it to the operating system without checking it properly. An attacker who can slip their own commands into that input gets the system to run them. In Dameware's case, the attacker must already be logged in — this is not an unauthenticated break-in, and it is not a disclosed authentication bypass. But "logged in" is a low bar here: the flaw needs only low-privilege access, and Dameware accounts are exactly the kind of credentials that exist in large numbers across an IT department.

That is also why the changed-scope rating matters. Dameware runs with elevated privileges by design — it exists to control other machines. A command-injection flaw in the tool that controls the machines hands the attacker the very machines the admins manage.

CVE	Flaw	CVSS	What it does
CVE-2026-28336	Command injection (CWE-20)	9.9 Critical	Authenticated attacker can run commands on the remotely controlled host
CVE-2026-28335	Buffer overflow (CWE-20)	8.4 High	Can result in remote code execution; authentication required; also reported by Bernatowicz
CVE-2026-28327	DLL hijacking (CWE-427)	8.2 High	Occurs during installations only; needs local access and admin privileges; found by Luiz Felipe Mol (Confu53)

Dameware 2026.3.1 is a bigger clean-up than one CVE. The release also updates two third-party libraries bundled with the product: Google Brotli (CVE-2026-111497 — the same Brotli decoder flaw behind our Cisco Node.js Brotli vulnerabilities explainer) and Apache Log4net (CVE-2026-40021). One update therefore closes flaws in Dameware itself and in the libraries it ships.

Illustrative image: server racks in a data centre — the infrastructure remote-support tools administer. Image: Wikimedia Commons, CC0.

Two distinctions keep the picture honest. First, an earlier Dameware flaw, CVE-2025-26396 — a privilege escalation caused by incorrect permissions in the Mini Remote Control Service — required local access and was fixed in Dameware 12.3.2. That is a different bug with a different fix; it does not cover CVE-2026-28336. Second, SolarWinds' recent Serv-U and Web Help Desk disclosures are separate products with separate patches; installing those does not remediate Dameware. Each product's version has to be tracked on its own.

Why it matters for India readers

India runs some of the world's largest IT services and help-desk operations, and remote-support tools like Dameware are deployed across enterprise IT teams that manage thousands of endpoints. That scale is what makes an authenticated, low-privilege flaw dangerous here: help-desk accounts are numerous, often shared between shifts, and sometimes left active long after the person who used them has moved on. A flaw that needs only a valid low-privilege login is aimed squarely at that reality.

There is also the vendor's history. SolarWinds is the company whose Orion platform sat at the centre of the 2020 Sunburst supply-chain attack, one of the most consequential intrusions of the decade. This Dameware flaw is a different product and a different class of bug — it is not Sunburst — but the name alone means security teams pay attention, and rightly so: a remote-administration tool is a privileged position in any network, and its flaws deserve the fastest patch cycle, not the routine one.

Should you care?

✅ Verdict: yes, if your organisation runs Dameware — update to 2026.3.1 now. The flaw is critical, the fix has existed since 3 November, and the only thing standing between an attacker and a controlled host is a login they may already have. ⏳ If you do not run Dameware, there is nothing to do — but check whether your IT team does, because remote-support tools are easy to forget in an asset inventory.

What to do now: the fix checklist

First, inventory: find every Dameware installation and confirm its version — anything at 2026.3 or earlier is affected. Second, upgrade to Dameware 2026.3.1, which closes all three flaws plus the Brotli and Log4net library issues in one move. Third, while the update rolls out, limit Dameware access to trusted admin accounts, remove accounts that are no longer needed, and restrict the tool to trusted networks. Fourth, review logs for unexpected commands or processes tied to remote-support sessions — SolarWinds has published no indicators of compromise, so look for the behaviour (odd commands, unusual session times) rather than a signature. Finally, keep automatic updates switched on for Dameware afterwards, so the next security release applies without anyone having to watch for it.

FAQs

What is CVE-2026-28336? It is a command-injection vulnerability in SolarWinds Dameware, rated 9.9 Critical. It lets an authenticated attacker with low privileges run commands on the remotely controlled host. SolarWinds disclosed it on 3 November 2026 and fixed it in Dameware 2026.3.1.

Which Dameware versions are affected by CVE-2026-28336? Dameware 2026.3 and all earlier versions. The fixed release is Dameware 2026.3.1. Older branches have no separate fix — upgrading to 2026.3.1 is the remediation.

How do I fix CVE-2026-28336? Upgrade Dameware to version 2026.3.1. Until the update is done, limit Dameware access to trusted admin accounts, remove unused accounts, and restrict the tool to trusted networks. The same update also fixes CVE-2026-28335 and CVE-2026-28327.

Is CVE-2026-28336 being exploited? No exploitation has been confirmed. SolarWinds' advisory reports no attacks in the wild and gives no indicators of compromise, and CISA's assessment in the CVE records lists exploitation as "none". That is the position today — but a 9.9 flaw in a remote-administration tool with a public advisory is exactly the kind attackers work on next, which is why patching now matters.

Takeaway: A remote-support tool is a privileged position in a network, and Dameware 2026.3.1 closes a 9.9 hole in it. Check your version, install the update, and prune the accounts that can reach it — the fix has been available since 3 November, so the risk now is only in waiting.

Follow World Tech on TechByCountry for tomorrow's update.

📸 Get tech in the last 24 hours on Instagram — follow @_techinlast24hrs for daily posts (9 AM–9 PM) and reels at 12:30 PM & 8:30 PM.

Sources

• SolarWinds Trust Center — SolarWinds Dameware Command Injection Vulnerability (CVE-2026-28336) (primary source: advisory first published 3 November 2026; affected versions, fixed release, severity 9.9, researcher credit)
• GBHackers — Critical SolarWinds Dameware Vulnerability Enables Attackers to Take Control of Remote Systems (4 November 2026; CVSS vector, authentication requirement, no confirmed exploitation, CVE-2025-26396 distinction)
• SecurityOnline.info — Dameware Command Injection CVE-2026-28336 (CVSS 9.9) Fixed (3 November 2026; three-CVE table, researchers, Brotli and Log4net library updates, CISA "none" assessment)
• Cyber Security News — Critical SolarWinds Dameware Flaw Could Allow Attackers to Compromise Remote Systems (4 November 2026; independent confirmation of advisory date, versions and researcher)
• AcidPeak — CVE-2026-28336: SolarWinds Dameware flaw can compromise remote hosts (CVE record summary; fix and mitigation)

Related reading on TechByCountry: our WordPress Core flaw exploited explainer shows the same lesson — a patch exists, attacks follow — and our Zyxel GS1900 zero-day explainer covers another recently exploited flaw.