CVE-2026-28327 PUBLISHED

SolarWinds Dameware DLL Hijacking Vulnerability

Assigner: SolarWinds
Reserved: 26.02.2026 Published: 03.11.2026 Updated: 04.11.2026

SolarWinds Dameware was found to be affected by a DLL hijacking vulnerability. The hijack occurs during installations only and requires access to the local machine and admin privileges.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CVSS Score: 8.2

Attack Vector	Local	Scope	Changed
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	Low	Integrity Impact	High
User Interaction	Required	Availability Impact	High

CVSS 3.1

Product Status

Vendor	SolarWinds
Product	Dameware
Versions	Default: affected affected from 0 to 2026.3 (incl.)

Solutions

SolarWinds recommends customers to upgrade to Dameware 2026.3.1 as soon as is practical.

Credits

Luiz Felipe Mol (Confu53) reporter

References

https://documentation.solarwinds.com/en/success_center/dameware/content/release_notes/dameware_2026-3-1_release_notes.htm
https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28327

Problem Types

CWE-427 Uncontrolled Search Path Element CWE

Impacts

CAPEC-175 Code Inclusion