SolarWinds published CVE-2026-28336 on 3 November 2026: a command injection flaw in Dameware that “could lead to the compromise of the remotely controlled host”. The attacker needs an authenticated account. SolarWinds rates it 9.9 Critical under CVSS 3.1 and fixes it in Dameware 2026.3.1, released the same day.
The CVE record lists versions up to and including 2026.3 as affected, and the vendor advisory says “2026.3 and all previous versions”. The record does not say which Dameware component carries the flaw, so we treat Mini Remote Control, Remote Support and the Central Server as in scope until SolarWinds says otherwise.
| Dameware release | Status | Source |
|---|---|---|
| 2026.3 and all earlier versions | Affected | CVE record, SolarWinds advisory |
| 2026.3.1 | Fixed, released 3 November 2026 | SolarWinds advisory and release notes |
| 12.3.2, 12.3.1 and 12.3 | End of life announced 31 March 2026; end of engineering 30 June 2026 | SolarWinds release notes |
What Does a 9.9 Score Mean for This Flaw?
The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, assigned by SolarWinds as the CNA. In plain terms, it is reachable over the network, needs no user click and only a low-privileged login. The changed scope means the damage reaches past the vulnerable component to the host being controlled. NVD lists the same vector from SolarWinds as a secondary source, and its status is still Awaiting Analysis.
There is no CVSS 4.0 score in the record or NVD. The SolarWinds page labels its vector as CVSS 3.0, while the CVE record and NVD both give 3.1. The weakness is CWE-20, improper input validation, tagged as CAPEC-248 command injection.
What Do SolarWinds, CISA and the CCCS Say About Exploitation?
SolarWinds credits Greg Bernatowicz of the Boeing Enterprise Security Red Team for the report. CISA’s SSVC entry on 3 November 2026 reads exploitation “none”, automatable “no” and technical impact “total”. The flaw was not in the CISA KEV catalogue in its 3 November 2026 release.
The Canadian Centre for Cyber Security issued AV26-1124 on 4 November 2026. It says versions “prior to or equal to 2026.3.1” are affected and names no CVE. That wording differs from the vendor, who lists 2026.3.1 as the fix, so we follow the vendor and CVE record.
Which Other Flaws Shipped in the Same Release?
The 2026.3.1 notes also fix CVE-2026-28335, a buffer overflow that can lead to remote code execution and needs authentication, rated 8.4 High. CVE-2026-28327 is a DLL hijack during installation, rated 8.2 High, and needs local access with admin rights. The notes also list a Brotli decoder fix rated 9.8 and a log4net update.
What Should Administrators Do Now?
- List every Dameware install: Central Server, Mini Remote Control and Remote Support, on admin workstations and helpdesk laptops.
- Back up registry settings and saved hosts before you upgrade Remote Support 12.2.4 or later and Mini Remote Control 12.2.2 or later. The release notes say the saved hosts protection changed.
- Upgrade to 2026.3.1. On Windows 7, SolarWinds says to install the security fixes in the linked Microsoft article first. Move the 12.3 line, which reached end of engineering on 30 June 2026, to 2026.3.1 too.
- Until then, limit who can log in to Dameware and from where, and remove stale accounts. The flaw needs a valid login, so account hygiene cuts the pool of possible attackers. This is our advice, not a SolarWinds mitigation.
- On controlled hosts, look for the Dameware service starting
cmd.exeorpowershell.exeoutside change windows. This is our detection idea for command and scripting interpreter use through a remote tool.
A remote control tool is a standing path into many hosts, which is why stolen logins matter. See our pages on Valid Accounts and External Remote Services for how attackers use such paths. SolarWinds lists no mitigation other than upgrading.