PolicyCortex
Request Access
Summary
  • An authenticated user could inject commands that run on the remotely controlled host.
  • The flaw scores 9.9 and needs only low privileges and no user interaction.
  • No exploitation in the wild has been confirmed. The flaw is not in KEV.
  • Update Dameware to 2026.3.1 and review who holds Dameware access.

SolarWinds fixed a critical flaw in Dameware on November 3, 2026. Dameware is a remote support tool. It lets an IT team control a remote host. The flaw is a command injection. It lets an authenticated user run commands on the remotely controlled host. The score is 9.9 on the Common Vulnerability Scoring System (CVSS) version 3.1.

The flaw

The record is CVE-2026-28336. Common Vulnerabilities and Exposures (CVE) is the public record system for flaws. SolarWinds scores the flaw 9.9. The vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The weakness is CWE-20, improper input validation. CWE means Common Weakness Enumeration. The flaw affects Dameware 2026.3 and all previous versions. The fix is Dameware 2026.3.1.

What attackers could do

An attacker needs a valid Dameware login first. Low privileges are enough. No user interaction is needed. The attacker sends crafted input that Dameware passes to the system without proper checks. The injected commands run on the remotely controlled host. The impact reaches confidentiality, integrity, and availability. Each is rated High. The scope changes, so the host beyond Dameware is at risk too. Greg Bernatowicz of the Boeing Enterprise Security Red Team reported the flaw.

No confirmed exploitation

No source reports exploitation in the wild. The flaw is not in the Known Exploited Vulnerabilities (KEV) catalog. KEV is run by the Cybersecurity and Infrastructure Security Agency (CISA). No public proof of concept has been reported. That status can change fast. A 9.9 score with low privileges is a short path to attack. Patch now, while the window is still open.

Two more flaws in the same release

Version 2026.3.1 also fixes two more flaws. One is a buffer overflow tracked as CVE-2026-28335. The other is a DLL hijacking flaw tracked as CVE-2026-28327. DLL means dynamic link library. Both flaws need authentication too. Install the full release to close all three.

What to do now

First, list every Dameware install. Record the version on each one. Second, update each install to 2026.3.1. Third, review who holds a Dameware login. Remove accounts that no longer need remote support access. Fourth, limit Dameware network access to trusted administrators only. Fifth, check Dameware logs for odd commands or odd sessions on controlled hosts.

The governance lesson

Dameware is a privileged tool by design. It controls other hosts. A flaw in it turns a low privilege login into host control. That is the lesson for every team. A remote support tool belongs in the system inventory with its version and its user list. Access to it must follow least privilege. Evidence must show the version and the user list are current. A tool that can run commands on any host deserves the same care as the hosts it controls.

Sources

Next step

Update every Dameware install to 2026.3.1. Then review the Dameware user list and file the dated proof.

Questions on this record
Which Dameware versions are affected?
Dameware 2026.3 and all previous versions are affected. Version 2026.3.1 fixes the flaw.
Has the flaw been exploited?
No. SolarWinds reports no confirmed exploitation. The flaw is not in the Known Exploited Vulnerabilities catalog.
Does the attacker need a login?
Yes. Authentication is required. The flaw needs a valid Dameware login with low privileges.

Related records

Guides and articles describe the work. The evidence that work produces is described in three proof pages and one architecture page.

proof.state
Proof of State. What the environment was, as of a date someone else picks: point-in-time records, content hashed and chained.
proof.change
Proof of Change. Who or what altered the environment, under what authority, with before and after state hashes.
proof.agency
Proof of Agency. What a machine was permitted to do before it acted, what it did, and what would have stopped it.
architecture
Architecture. How the chain is built and where it lives: inside your tenant, with no egress of evidence.

Further reading in this register

  1. SonicWall SSLVPN Flaw Lets Valid Logins Skip SAML and MFASonicWall fixed an SSLVPN flaw scored 7.1 that lets a valid alternate login skip SAML and its multi-factor check. CISA added it to the Known Exploited Vulnerabilities catalog on November 6, 2026.5 min
  2. FBI and CISA Warn That Attackers Are Targeting Refrigeration ControllersA joint advisory dated November 5, 2026 warns that attackers target refrigeration controllers in grocery and cold storage sites. The fix starts with removing internet exposure and changing default passwords.5 min
  3. GPUStack Auth Bypass Gave Attackers Admin Access With No LoginGPUStack fixed an auth bypass scored 9.8. Attackers had already used it in the wild. Update to 2.2.2 or later.5 min

Verify the record this entry describes.

Request AccessBook a call
Published
Last updated
Unchanged since publication
Author
Leonard Esere