Critical · 1 source · latest 2h

Critical SolarWinds Dameware flaw CVE-2026-28336 lets authenticated attackers compromise hosts

CRITICAL · VULNERABILITYCVE-2026-28336redteam/daily · 1 source

Severity: Critical
Highest CVSS: 9.9
Exploited: Not known
Sources: 1

What happened

CVE-2026-28336 is a critical command injection flaw in SolarWinds Dameware, scored CVSS 9.9. It allows an authenticated attacker to remotely compromise controlled hosts and affects Dameware 2026.3 and all earlier versions. SolarWinds has released 2026.3.1 as the fix. Defenders should identify Dameware deployments, upgrade to 2026.3.1 or later, and review access to the product's authenticated accounts.

For security analysts · Written by AI from 1 source · Wrong?

What to do

Update Dameware to version 2026.3.1 or later, as released by SolarWinds.
Check whether your organisation runs Dameware 2026.3 or any earlier version.

Written by AI from the sources, checked against them

Read the full story at the source

Vulnerabilities

CVE-2026-28336CVSS 9.9SolarWinds Dameware was found to be affected by a command injection vulnerability that could lead to the compromise of the remotely controlled host. Authentication is required.

Full story timeline · 2 updates

Tue 3 November17:18CVE-2026-28336 published, CVSS 9.9NVD
Wed 4 November05:06Critical SolarWinds Dameware Vulnerability Enables Attackers to Take Control of Remote SystemsGBHackers

Who reported · 1 outlet

GBHackers