Critical SolarWinds Dameware Flaw Could Allow Attackers to Compromise Remote Systems

What happened?

SolarWinds has warned about a critical command injection flaw in its Dameware remote support software. It is tracked as CVE-2026-28336 and carries a severity score of 9.9 out of 10. The bug could let an attacker take over a computer that an IT team is controlling remotely. Dameware is widely used by help desks and administrators to connect to and fix remote computers. Since the tool runs with strong access, a flaw in it is risky for any company that depends on it. SolarWinds published the advisory on November 3, 2026, and urged users to update quickly.

Key details

• SolarWinds disclosed a critical command injection vulnerability in Dameware remote support software.
• The flaw is tracked as CVE-2026-28336 with a CVSS severity score of 9.9 out of 10.
• The vulnerability affects Dameware 2026.3 and all earlier versions.
• SolarWinds released Dameware 2026.3.1 as the fixed version.
• Greg Bernatowicz of Boeing Enterprise Security Red Team was credited for discovering the flaw.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.