{"id":"CVE-2026-28336","kind":"vulnerability","aliases":["CVE-2026-28336"],"related":[],"title":"SolarWinds Dameware: command injection lets an authenticated user compromise remote hosts","description":"SolarWinds Dameware was found to be affected by a command injection vulnerability that could lead to the compromise of the remotely controlled host. Authentication is required.","summary":"SolarWinds Dameware, a remote-control tool for administrators, has a command injection flaw. An attacker with valid credentials can run commands and compromise the host being controlled remotely.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Dameware","fixed":["2026.3.1"],"affected":"<= 2026.3","ecosystem":"vendor"}],"ecosystems":[],"tags":["authenticated","command-injection","dameware","other","remote-access","solarwinds"],"not_affected_if":["no-dameware-installed"],"how_to_check":"Check the installed Dameware version on admin consoles and on hosts running the Dameware agent. 2026.3 or earlier is affected; 2026.3.1 is fixed.","fix":"Upgrade SolarWinds Dameware to 2026.3.1 (released 2026-11-03).","status":"open","published_at":"2026-11-03T17:18:12+00:00","first_seen_at":"2026-11-03T17:21:57+00:00","triaged_at":"2026-11-03T17:23:55+00:00","updated_at":"2026-11-03T17:24:43+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-11-03T17:23:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"SolarWinds Dameware: command injection lets an authenticated user compromise remote hosts","impact":"high","summary":"SolarWinds Dameware, a remote-control tool for administrators, has a command injection flaw. An attacker with valid credentials can run commands and compromise the host being controlled remotely.","audience":"businesses","category":"other","nicknames":[],"who_cares":["solarwinds","dameware","remote-access"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker runs commands on remotely controlled hosts","analyst_note":"Find affected Dameware versions and the vendor fix from the NVD entry and SolarWinds advisory; confirm whether the attack is network-reachable.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-dameware-installed"],"who_is_affected":"Organizations running SolarWinds Dameware for remote support or administration are exposed. The sources do not name affected versions or configurations. Teams that do not run Dameware can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000623,"input_tokens":4076,"output_tokens":431,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find affected Dameware versions and the vendor fix from the NVD entry and SolarWinds advisory; confirm whether the attack is network-reachable.","search":"'-2026':13A,16A '-28336':14A,17A 'access':27B 'administr':37B 'affect':64C 'attack':44B 'authent':7A,19B,81C 'command':3A,21B,40B,50B,67C 'command-inject':20B 'compromis':9A,52B,75C 'control':34B,56B,79C 'could':71C 'credenti':47B 'cve':12A,15A 'damewar':2A,23B,30B,59C 'dameware':18A 'flaw':42B 'found':61C 'host':11A,54B,80C 'inject':4A,22B,41B,68C 'lead':72C 'let':5A 'remot':10A,26B,33B,57B,78C 'remote-access':25B 'remote-control':32B 'requir':83C 'run':49B 'solarwind':1A,28B,29B,58C 'tool':35B 'user':8A 'valid':46B 'vulner':69C","nicknames":[],"mitigations":[],"who_affected":"Anyone running SolarWinds Dameware 2026.3 or any earlier version is affected. The attack is reachable over the network but needs a valid low-privilege login; a successful command injection can compromise the remotely controlled host. Teams that do not use Dameware can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-03T17:24:43Z","by":"analyst","doc":"https://documentation.solarwinds.com/en/success_center/dameware/content/release_notes/dameware_2026-3-1_release_notes.htm","run_id":1509},"products":{"at":"2026-11-03T17:24:43Z","by":"analyst","doc":"https://documentation.solarwinds.com/en/success_center/dameware/content/release_notes/dameware_2026-3-1_release_notes.htm","run_id":1509},"who_affected":{"at":"2026-11-03T17:24:43Z","by":"analyst","doc":"https://documentation.solarwinds.com/en/success_center/dameware/content/release_notes/dameware_2026-3-1_release_notes.htm","run_id":1509}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["dameware"],"ptokens":["dameware"],"labels":["authenticated","commandinjection","critical","dameware","other","remoteaccess","solarwinds"],"campaign_type":null,"first_public_at":"2026-11-03T17:18:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"psirt@solarwinds.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-28336","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28336","severity":null,"published_at":"2026-11-03T17:18:12+00:00","modified_at":"2026-11-03T17:18:12+00:00","first_seen_at":"2026-11-03T17:21:57+00:00","fetched_at":"2026-11-03T17:21:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-28336:1509","url":null,"severity":null,"published_at":"2026-11-03T17:24:43+00:00","modified_at":"2026-11-03T17:24:43+00:00","first_seen_at":"2026-11-03T17:24:43+00:00","fetched_at":"2026-11-03T17:24:43+00:00","note":"SolarWinds advisory: affected 2026.3 and earlier, fixed 2026.3.1 (release notes dated Nov 3 2026). CVSS 9.9 AV:N PR:L. No exploitation or PoC found; no mitigations stated; how_to_check not in vendor text so unverified."}],"documents":[{"id":59263,"url":"https://www.solarwinds.com/trust-center/security-advisories/cve-2026-28336","title":"SolarWinds advisory CVE-2026-28336","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":59265,"url":"https://documentation.solarwinds.com/en/success_center/dameware/content/release_notes/dameware_2026-3-1_release_notes.htm","title":"Dameware 2026.3.1 release notes","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}