---
id: "CVE-2026-28336"
kind: "vulnerability"
aliases: ["CVE-2026-28336"]
title: "SolarWinds Dameware: command injection lets an authenticated user compromise remote hosts"
severity: "critical"
cvss: 9.9
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Dameware", "fixed": ["2026.3.1"], "affected": "<= 2026.3", "ecosystem": "vendor"}]
ecosystems: []
tags: ["authenticated", "command-injection", "dameware", "other", "remote-access", "solarwinds"]
not_affected_if: ["no-dameware-installed"]
published_at: "2026-11-03T17:18:12+00:00"
first_seen_at: "2026-11-03T17:21:57+00:00"
updated_at: "2026-11-03T17:24:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28336", "first_seen_at": "2026-11-03T17:21:57+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T17:24:43+00:00"}]
---

# SolarWinds Dameware: command injection lets an authenticated user compromise remote hosts

SolarWinds Dameware, a remote-control tool for administrators, has a command injection flaw. An attacker with valid credentials can run commands and compromise the host being controlled remotely.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Dameware affected <= 2026.3 fixed 2026.3.1

## How to check

Check the installed Dameware version on admin consoles and on hosts running the Dameware agent. 2026.3 or earlier is affected; 2026.3.1 is fixed.

## Fix

Upgrade SolarWinds Dameware to 2026.3.1 (released 2026-11-03).

## Timeline

- 2026-11-03T17:21:57+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-28336
- 2026-11-03T17:24:43+00:00 analyst — SolarWinds advisory: affected 2026.3 and earlier, fixed 2026.3.1 (release notes dated Nov 3 2026). CVSS 9.9 AV:N PR:L. No exploitation or PoC found; no mitigations stated; how_to_check not in vendor text so unverified.

## Documents

- [advisory] SolarWinds advisory CVE-2026-28336 https://www.solarwinds.com/trust-center/security-advisories/cve-2026-28336
- [fix] Dameware 2026.3.1 release notes https://documentation.solarwinds.com/en/success_center/dameware/content/release_notes/dameware_2026-3-1_release_notes.htm

## From the sources

SolarWinds Dameware was found to be affected by a command injection vulnerability that could lead to the compromise of the remotely controlled host. Authentication is required.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_