SolarWinds Dameware command injection flaw could allow remote system compromise
Critical CVE-2026-28336 in SolarWinds Dameware allows attackers to take over remotely controlled computers.
80
CVE-2026-28336
Command injection in SolarWinds Dameware (requires authentication)
- CVSS 3.1
- 9.9 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
SolarWinds Dameware has a command injection flaw that lets authenticated remote users compromise the remotely controlled host. The issue is triggered over the network. All SolarWinds Dameware users are affected.
What to do: Apply SolarWinds update for CVE-2026-28336
| Product | Affected |
|---|---|
| SolarWinds Dameware | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
SolarWinds Dameware was found to be affected by a command injection vulnerability that could lead to the compromise of the remotely controlled host. Authentication is required.
- Weakness
- CWE-20
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
In the news
2 storiesSolarWinds Dameware command injection lets authenticated attackers take control
SolarWinds Dameware 2026.3 command injection vulnerability allows remote compromise; fixed in 2026.3.1.
75