SolarWinds patches critical command injection flaw in Dameware

SolarWinds says it has patched a critical command injection flaw in Dameware, tracked as CVE-2026-28336, with the release of Dameware 2026.3.1. The vendor rates the vulnerability at CVSSv3 9.9 and warns that exploitation could lead to the compromise of a remotely controlled host. The 2026.3.1 release also fixes two additional high-severity flaws and two third‑party library issues.

In the disclosure, Dameware 2026.3 and earlier are listed as affected, and administrators are urged to upgrade to 2026.3.1 to close the flaw. No confirmed exploitation is publicly noted in the vendor advisory, and CISA’s CVE records similarly indicate no confirmed exploitation at this time.

The other two CVEs tied to the same advisory are CVE-2026-28335, a buffer overflow rated CVSS 8.4, which SolarWinds says can lead to remote code execution and also requires authentication, and CVE-2026-28327, a DLL hijacking flaw rated CVSS 8.2 that occurs during installations and requires local admin privileges. The claims cite researchers including Greg Bernatowicz of Boeing’s Enterprise Security Red Team for the command injection and buffer overflow, and Luiz Felipe Mol (Confu53) for the DLL hijack.

SolarWinds notes affected releases include all Dameware versions up to and including 2026.3, and the recommended mitigations aside from upgrading include restricting Dameware access to trusted admin accounts.

CISA’s CVE records list exploitation as “none.” The vendor’s advisory directs customers to apply the 2026.3.1 patch and to follow accompanying guidance in the release notes.