SolarWinds Dameware command injection flaw could allow remote system compromise
Original title: Critical SolarWinds Dameware Flaw Could Allow Attackers to Compromise Remote Systems
Critical CVE-2026-28336 in SolarWinds Dameware allows attackers to take over remotely controlled computers.
SolarWinds has warned about a critical command injection flaw in its Dameware remote support software. The bug could let an attacker take over a computer that an IT team is controlling remotely. Dameware is widely used by help desks and administrators to connect to and fix remote computers. SolarWinds published the advisory on November 3, 2026, and urged users to update quickly. The issue affects SolarWinds Dameware 2026.3 and all earlier versions. The fixed release is Dameware 2026.3.1. No malware is tied to this flaw and the advisory does not report any attacks in the wild.
- Affects 2026.3 and all earlier versions
- Fixed in 2026.3.1
- CVSS score 9.9
- No attacks reported in the wild
- CVEs
- CVE-2026-28336
- Vendors
- SolarWinds
- Products
- Dameware
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-28336 | Command injection in SolarWinds Dameware (requires authentication) | 9.9 | — |
From the original article
2 min read at cybersecuritynews.com
SolarWinds has warned about a critical command injection flaw in its Dameware remote support software. It is tracked as CVE-2026-28336 and carries a severity score of 9. 9 out of 10.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.