CVE-2026-28336: SolarWinds Dameware Command Injection Vulnerability

Published Nov 3, 2026

Updated

SolarWinds Dameware was found to be affected by a command injection vulnerability that could lead to the compromise of the remotely controlled host. Authentication is required.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade SolarWinds Dameware to a version that resolves this vulnerability.
Fixed in 2026.3.1

Event History

Nov 3, 2026

CVE Published

via MITRE·04:23 PM

Data Sourced

via MITRE·04:23 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·05:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attacker must be authenticated. The available information does not specify what privilege level or Dameware role is required.

Which systems are at risk if exploitation succeeds?

The remotely controlled host can be compromised. The vulnerability has network attack vector, low attack complexity, requires no user interaction, and can affect confidentiality, integrity, and availability.

How urgent is remediation?

The issue is rated critical with a CVSS score of 9.9. Because successful exploitation can compromise a remotely controlled host, prioritize remediation for Dameware deployments accessible to authenticated users.

CVE-2026-28336: SolarWinds Dameware Command Injection Vulnerability

Remediation

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which systems are at risk if exploitation succeeds?

How urgent is remediation?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which systems are at risk if exploitation succeeds?

How urgent is remediation?