{"id":"CVE-2026-28327","kind":"vulnerability","aliases":["CVE-2026-28327"],"related":[],"title":"SolarWinds Dameware: DLL hijacking during installation lets an admin-level local user gain code execution","description":"SolarWinds Dameware was found to be affected by a DLL hijacking vulnerability. The hijack occurs during installations only and requires access to the local machine and admin privileges.","summary":"SolarWinds Dameware is affected by a DLL hijacking flaw that occurs during installation. An attacker with local access and admin privileges can place a malicious DLL that the installer loads.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Dameware","fixed":["2026.3.1"],"affected":"<= 2026.3","ecosystem":"vendor"}],"ecosystems":[],"tags":["dameware","dll-hijacking","other","solarwinds","windows"],"not_affected_if":["dameware-2026.3.1-or-later","no-dameware-install","no-local-access"],"how_to_check":"Check the installed Dameware version (Mini Remote Control, Remote Support, Central Server) on Windows hosts. Version 2026.3 or earlier is affected; 2026.3.1 is fixed. Review who has admin rights and where installers are run from before the upgrade.","fix":"Upgrade Dameware to 2026.3.1 (SolarWinds customer portal).","status":"open","published_at":"2026-11-03T17:18:12+00:00","first_seen_at":"2026-11-03T17:21:57+00:00","triaged_at":"2026-11-03T17:24:03+00:00","updated_at":"2026-11-03T17:24:46+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-11-03T17:24:03Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"SolarWinds Dameware: DLL hijacking during installation lets an admin-level local user gain code execution","impact":"high","summary":"SolarWinds Dameware is affected by a DLL hijacking flaw that occurs during installation. An attacker with local access and admin privileges can place a malicious DLL that the installer loads.","audience":"businesses","category":"other","nicknames":[],"who_cares":["dameware","windows","solarwinds"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local admin attacker runs code during Dameware installation","analyst_note":"Find the SolarWinds advisory and the affected and fixed Dameware versions, and confirm whether the DLL load path is controllable at install time.","how_to_check":"- Check whether Dameware is installed on Windows machines, for example by looking for the Dameware program files directory.\n- Check the installed Dameware version against the vendor advisory: unknown.","plain_action":"","needs_analyst":true,"not_affected_if":["no-dameware-install","no-local-access"],"who_is_affected":"Teams that run SolarWinds Dameware on Windows machines. The sources say the hijack happens only during installations and needs local access and admin privileges, so exposure is limited to installation activity on hosts where an attacker already has admin rights. The sources do not say which Dameware versions are affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000671,"input_tokens":4075,"output_tokens":527,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the SolarWinds advisory and the affected and fixed Dameware versions, and confirm whether the DLL load path is controllable at install time.","search":"'-2026':18A,21A '-28327':19A,22A 'access':48B,81C 'admin':10A,50B,87C 'admin-level':9A 'affect':34B,67C 'attack':45B 'code':15A 'cve':17A,20A 'damewar':2A,24B,32B,62C 'dameware':23A 'dll':3A,26B,37B,56B,70C 'dll-hijack':25B 'execut':16A 'flaw':39B 'found':64C 'gain':14A 'hijack':4A,27B,38B,71C,74C 'instal':6A,43B,59B,77C 'let':7A 'level':11A 'load':60B 'local':12A,47B,84C 'machin':85C 'malici':55B 'occur':41B,75C 'place':53B 'privileg':51B,88C 'requir':80C 'solarwind':1A,29B,31B,61C 'user':13A 'vulner':72C 'window':30B","nicknames":[],"mitigations":[],"who_affected":"Teams running SolarWinds Dameware 2026.3 or any earlier version on Windows. The DLL hijack happens only while installing, and needs local access and admin privileges, so it matters on hosts where installers are run by or near less-trusted admins. Skip it if you have no Dameware or never run its installers on shared hosts.","tier":"B","verified":{"fix":{"at":"2026-11-03T17:24:46Z","by":"analyst","doc":"https://documentation.solarwinds.com/en/success_center/dameware/content/release_notes/dameware_2026-3-1_release_notes.htm","run_id":1512},"products":{"at":"2026-11-03T17:24:46Z","by":"analyst","doc":"https://documentation.solarwinds.com/en/success_center/dameware/content/release_notes/dameware_2026-3-1_release_notes.htm","run_id":1512},"how_to_check":{"at":"2026-11-03T17:24:46Z","by":"analyst","doc":"https://documentation.solarwinds.com/en/success_center/dameware/content/release_notes/dameware_2026-3-1_release_notes.htm","run_id":1512},"who_affected":{"at":"2026-11-03T17:24:46Z","by":"analyst","doc":"https://documentation.solarwinds.com/en/success_center/dameware/content/release_notes/dameware_2026-3-1_release_notes.htm","run_id":1512}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["dameware"],"ptokens":["dameware"],"labels":["dameware","dllhijacking","high","other","solarwinds","windows"],"first_public_at":"2026-11-03T17:18:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","cvss_by":"psirt@solarwinds.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-28327","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28327","severity":null,"published_at":"2026-11-03T17:18:12+00:00","modified_at":"2026-11-03T17:18:12+00:00","first_seen_at":"2026-11-03T17:21:57+00:00","fetched_at":"2026-11-03T17:21:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-28327:1512","url":null,"severity":null,"published_at":"2026-11-03T17:24:46+00:00","modified_at":"2026-11-03T17:24:46+00:00","first_seen_at":"2026-11-03T17:24:46+00:00","fetched_at":"2026-11-03T17:24:46+00:00","note":"SolarWinds advisory: affected Dameware 2026.3 and all earlier; fixed 2026.3.1 (released 2026-11-03). Vendor does not say which DLL or load path; install-time only, needs local access + admin. No exploitation or PoC found."}],"documents":[{"id":59267,"url":"https://www.solarwinds.com/trust-center/security-advisories/cve-2026-28327","title":"SolarWinds Trust Center: CVE-2026-28327","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":59265,"url":"https://documentation.solarwinds.com/en/success_center/dameware/content/release_notes/dameware_2026-3-1_release_notes.htm","title":"Dameware 2026.3.1 release notes","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}