CVE-2026-28336 PUBLISHED

SolarWinds Dameware Command Injection Vulnerability

Assigner: SolarWinds
Reserved: 26.02.2026 Published: 03.11.2026 Updated: 04.11.2026

SolarWinds Dameware was found to be affected by a command injection vulnerability that could lead to the compromise of the remotely controlled host. Authentication is required.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS Score: 9.9

Attack Vector	Network	Scope	Changed
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	Low	Integrity Impact	High
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	SolarWinds
Product	Dameware
Versions	Default: affected affected from 0 to 2026.3 (incl.)

Solutions

SolarWinds recommends customers to upgrade to Dameware version 2026.3.1 as soon as is practical.

Credits

Greg Bernatowicz on the Boeing Enterprise Security Red Team reporter

References

https://documentation.solarwinds.com/en/success_center/dameware/content/release_notes/dameware_2026-3-1_release_notes.htm
https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28336

Problem Types

CWE-20 Improper Input Validation CWE

Impacts

CAPEC-248 Command Injection