{"id":"CVE-2026-28335","kind":"vulnerability","aliases":["CVE-2026-28335"],"related":[],"title":"SolarWinds Dameware: buffer overflow lets an authenticated user run code","description":"SolarWinds Dameware was found to be affected by a buffer overflow vulnerability that can result in remote code execution. Authentication is required.","summary":"SolarWinds Dameware, a remote-support tool for administering Windows machines, has a buffer overflow that can lead to remote code execution. An attacker who already holds valid credentials can run code on the affected host.","severity":"high","cvss":8.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Dameware","fixed":["2026.3.1"],"affected":"<= 2026.3","ecosystem":"vendor"}],"ecosystems":[],"tags":["authenticated","dameware","infrastructure","remote-support","solarwinds","windows"],"not_affected_if":["auth-required","no-dameware-installed","unauthenticated-access-blocked"],"how_to_check":"Check installed Dameware version (About dialog or Installed apps) on every DRS/MRC host and admin console; 2026.3 or earlier is affected. Also check whether the Dameware agent/MRC service is reachable from untrusted networks.","fix":"Upgrade SolarWinds Dameware to 2026.3.1","status":"open","published_at":"2026-11-03T17:18:12+00:00","first_seen_at":"2026-11-03T17:21:57+00:00","triaged_at":"2026-11-03T17:23:59+00:00","updated_at":"2026-11-03T17:24:44+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-03T17:23:59Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"SolarWinds Dameware: buffer overflow lets an authenticated user run code","impact":"high","summary":"SolarWinds Dameware, a remote-support tool for administering Windows machines, has a buffer overflow that can lead to remote code execution. An attacker who already holds valid credentials can run code on the affected host.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["solarwinds","dameware","windows","remote-support"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"code runs on the host with the Dameware service's privileges","analyst_note":"Find affected version ranges and the fixed release in the SolarWinds advisory for CVE-2026-28335; NVD alone does not list them.","how_to_check":"- Check the installed Dameware version in the product's About or installed-programs list; the affected versions are unknown from the sources.\n- Confirm whether the Dameware Remote Support or Mini Remote Control service is reachable from untrusted networks.","plain_action":"","needs_analyst":true,"not_affected_if":["no-dameware-installed","unauthenticated-access-blocked"],"who_is_affected":"Teams that run SolarWinds Dameware to remotely administer machines are the ones exposed. Exposure depends on who holds valid credentials and whether the service is reachable from networks outside the trusted administration zone; the sources do not list affected versions.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000681,"input_tokens":4071,"output_tokens":547,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find affected version ranges and the fixed release in the SolarWinds advisory for CVE-2026-28335; NVD alone does not list them.","search":"'-2026':12A,15A '-28335':13A,16A 'administ':34B 'affect':60B,68C 'alreadi':51B 'attack':49B 'authent':7A,18B,81C 'buffer':3A,39B,71C 'code':10A,46B,57B,79C 'credenti':54B 'cve':11A,14A 'damewar':2A,19B,27B,63C 'dameware':17A 'execut':47B,80C 'found':65C 'hold':52B 'host':61B 'infrastructur':20B 'lead':43B 'let':5A 'machin':36B 'overflow':4A,40B,72C 'remot':22B,30B,45B,78C 'remote-support':21B,29B 'requir':83C 'result':76C 'run':9A,56B 'solarwind':1A,24B,26B,62C 'support':23B,31B 'tool':32B 'user':8A 'valid':53B 'vulner':73C 'window':25B,35B","nicknames":[],"mitigations":[],"who_affected":"Any Windows system running SolarWinds Dameware (Remote Support / Mini Remote Control) version 2026.3 or earlier is affected. An attacker needs valid credentials, then can send input that overflows a buffer and may run code remotely (CVSS 8.4, network, high complexity). Teams that do not use Dameware can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-03T17:24:44Z","by":"analyst","doc":"https://documentation.solarwinds.com/en/success_center/dameware/content/release_notes/dameware_2026-3-1_release_notes.htm","run_id":1511},"products":{"at":"2026-11-03T17:24:44Z","by":"analyst","doc":"https://documentation.solarwinds.com/en/success_center/dameware/content/release_notes/dameware_2026-3-1_release_notes.htm","run_id":1511},"how_to_check":{"at":"2026-11-03T17:24:44Z","by":"analyst","doc":"https://documentation.solarwinds.com/en/success_center/dameware/content/release_notes/dameware_2026-3-1_release_notes.htm","run_id":1511},"who_affected":{"at":"2026-11-03T17:24:44Z","by":"analyst","doc":"https://documentation.solarwinds.com/en/success_center/dameware/content/release_notes/dameware_2026-3-1_release_notes.htm","run_id":1511}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["dameware"],"ptokens":["dameware"],"labels":["authenticated","dameware","high","infrastructure","remotesupport","solarwinds","windows"],"campaign_type":null,"first_public_at":"2026-11-03T17:18:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L","cvss_by":"psirt@solarwinds.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-28335","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28335","severity":null,"published_at":"2026-11-03T17:18:12+00:00","modified_at":"2026-11-03T17:18:12+00:00","first_seen_at":"2026-11-03T17:21:57+00:00","fetched_at":"2026-11-03T17:21:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-28335:1511","url":null,"severity":null,"published_at":"2026-11-03T17:24:44+00:00","modified_at":"2026-11-03T17:24:44+00:00","first_seen_at":"2026-11-03T17:24:44+00:00","fetched_at":"2026-11-03T17:24:44+00:00","note":"SolarWinds advisory + 2026.3.1 release notes: affected 2026.3 and earlier, fixed 2026.3.1. Not exploited/no PoC found; no social search done (new, same-day disclosure)."}],"documents":[{"id":59264,"url":"https://www.solarwinds.com/trust-center/security-advisories/cve-2026-28335","title":"SolarWinds advisory CVE-2026-28335","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":59265,"url":"https://documentation.solarwinds.com/en/success_center/dameware/content/release_notes/dameware_2026-3-1_release_notes.htm","title":"Dameware 2026.3.1 release notes","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}