On this page (7 sections)
SolarWinds Dameware, a remote control and remote support product, has a command injection vulnerability tracked as CVE-2026-28336. According to the NVD record, it could lead to the compromise of the remotely controlled host, and authentication is required.
Anyone who runs Dameware to support servers, workstations or customer machines should care, including IT teams, agencies and hosting administrators. The public detail is short, so this article separates what is confirmed from what is not and gives practical steps you can take now.
What happened
The vulnerability was published to the NVD on 2026-11-03. The description is a single sentence: SolarWinds Dameware was found to be affected by a command injection vulnerability that could lead to the compromise of the remotely controlled host, and authentication is required.
NVD lists two references, both from SolarWinds: a security advisory for CVE-2026-28336 and the Dameware 2026.3.1 release notes. The research available to us does not reproduce the contents of either page, so we cannot confirm from them which versions are affected or exactly which version contains the fix. The release notes link suggests the fix shipped in or around 2026.3.1, but treat that as something to verify, not a confirmed fact.
What command injection means here
Command injection happens when software passes attacker-influenced input into an operating system command without properly restricting it. The program then runs commands the author never intended. NVD classifies this issue under CWE-20, improper input validation, which is the broader mistake of trusting input that has not been checked.
In a remote control tool the impact is amplified. The product exists to act on another machine with high privileges, so a flaw in that path can turn a legitimate session into code execution on the controlled host. NVD describes the outcome as compromise of the remotely controlled host.
Who is realistically exposed
Because authentication is required, an attacker needs valid access first. That lowers the risk compared with an unauthenticated flaw, but it does not remove it. A CVSS score of 9.9 reflects the severity of the result, and these paths are realistic ways to get the needed access:
- Stolen, reused or phished credentials for a Dameware user or the accounts it relies on.
- A low-privileged or compromised insider account that can start remote sessions.
- Shared support accounts used by contractors or agencies.
- Remote support consoles reachable from the internet or from broad internal networks.
The sources do not say whether the weakness sits in the technician console, the agent on the remote host, or both. Until the vendor advisory clarifies this, assume every machine running a Dameware component is in scope.
How to check your exposure
Start with an inventory. You need to know where Dameware components are installed and which version each one runs.
- List every system with a Dameware console, mini remote control agent or related service. Check software inventory tools, endpoint management and your own documentation.
- Record the installed version on each system from the application's About screen or the installed programs list.
- Open the SolarWinds advisory for CVE-2026-28336 and the 2026.3.1 release notes and compare their affected and fixed versions with your inventory.
- Identify who can authenticate to Dameware and from which networks it is reachable.
On Windows, this read-only PowerShell command lists installed programs whose name contains Dameware, with their versions. Run it in an elevated PowerShell window on a host you want to check. It only reads the uninstall registry keys.
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*, HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object { $_.DisplayName -like '*Dameware*' } | Select-Object DisplayName, DisplayVersionWhat to do now
The most reliable fix is the vendor's. Read the SolarWinds advisory, then update to the fixed release it names.
0 of 7 done
Detection and monitoring
No indicators of compromise or exploitation details appear in the sources, so there is no reliable signature to hunt for. Focus on behavior around the remote control tooling.
- Unexpected child processes or shell activity started by Dameware processes on controlled hosts.
- Remote sessions at unusual hours, from unusual accounts or from unfamiliar source addresses.
- New local accounts, scheduled tasks or services created shortly after a remote session.
- Failed and successful logins to the accounts that Dameware uses.
If a host looks suspicious, follow our guide on what to do when a website or server is hacked. If Dameware controls servers that host your sites, also run an outside-in check with the free malware scanner and keep an eye on certificate and DNS changes with monitoring, since attackers who reach a server often change those. Neither replaces patching, and an outside scan cannot see inside a remote support tool.
What we do not know yet
Be cautious about anything stated beyond the following confirmed points: the CVE ID, the NVD description, the CVSS 9.9 score, the CWE-20 classification, the 2026-11-03 publication date and the requirement for authentication. We have not seen confirmed affected version ranges, a proof of concept, or reports of exploitation. Only one independent publisher covers this story so far, so details may change as SolarWinds and others publish more. We will revisit the facts as the vendor advisory is analyzed.
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.