Critical SolarWinds Dameware Flaw Allows Command Injection

SolarWinds has issued a critical security advisory for CVE-2026-28336, a severe command injection vulnerability affecting its Dameware remote support software. The flaw, which carries a CVSS score of 9.9 out of 10, could allow an authenticated attacker to gain control over remote systems managed by IT professionals.

Dameware is a widely adopted tool used by IT help desks and administrators for remote access and support. Given its privileged access, any vulnerability within the software poses a significant risk to organizations relying on it for system management. SolarWinds published the advisory on November 3, 2026, urging immediate action from users.

The vulnerability requires an attacker to possess valid login credentials for the Dameware system. Once authenticated, the attacker can exploit the flaw without any user interaction. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) indicates that the attack can be launched over a network with low complexity, affecting confidentiality, integrity, and availability with high impact, and potentially spreading to the remote host.

This command injection flaw specifically targets how the software handles user input, allowing an attacker to inject and execute arbitrary system commands. The impact is significant, as it can lead to a full compromise of the remotely controlled host. The vulnerability affects Dameware versions 2026.3 and earlier. The patched version is 2026.3.1.

Greg Bernatowicz from the Boeing Enterprise Security Red Team is credited with discovering this vulnerability. While SolarWinds has not reported any active exploitation in the wild or any associated malware, the company's history with exploited vulnerabilities, such as those in Web Help Desk, underscores the urgency of patching.

Organizations using Dameware are strongly advised to update to version 2026.3.1 immediately. Additional security measures include reviewing and revoking unnecessary Dameware accounts, limiting network access to the tool, and closely monitoring logs for suspicious commands. The company has also recently released security fixes for other products, including Observability and Serv-U, highlighting ongoing security efforts.

This incident serves as a critical reminder for organizations to maintain robust patch management practices and to regularly audit access controls for privileged remote management tools. The potential for widespread compromise through a single, critical vulnerability in a widely used tool like Dameware necessitates swift and decisive action from IT security teams.