I’M UNDER A CYBER ATTACK

Alert

Alert 2026-140 SolarWinds Dameware flaws allow compromise of remote hosts

Affected product(s):

ProductAffected versions
SolarWinds Dameware2026.3 and all earlier versions

The vendor does not specify which component of Dameware contains the vulnerabilities.

Description

Two vulnerabilities have been published in SolarWinds Dameware, a support and remote control tool used in corporate environments. Due to its function, a compromise of Dameware can spread to the devices managed through it.

The most severe has been labeled CVE-2026-28336 (CVSSv3.1 9.9 – CRITICAL) and is a command injection vulnerability. The vendor indicated that it can lead to compromise of the remotely controlled device. It requires authentication, but according to the published vector, low privileges are sufficient; it does not require user interaction, has low complexity, and its impact extends to systems outside the vulnerable component (scope changed).

The second has been labeled CVE-2026-28335 (CVSSv3.1 8.4 – HIGH) and is a buffer overflow that, according to the vendor, can result in remote code execution. It also requires authentication with low privileges, and its attack complexity is high.

As of Nov 4, 2026, there are no reports of active exploitation or public proofs of concept, and neither is listed in catalogs of known exploited vulnerabilities. The vendor did not publish additional technical details.

Mitigation

The vendor did not publish mitigations or alternative solutions; the solution is to update. In the meantime, it is recommended:

  • Restrict access to Dameware to administrative networks or VPNs and do not expose it to the Internet.
  • Review accounts with access to Dameware, remove those that are not used, and apply least privilege and MFA where possible, as both vulnerabilities require an authenticated account.
  • Review the logs of managed devices for unusual processes or commands.

Solution

The solution consists of updating SolarWinds Dameware to version 2026.3.1, which fixes both vulnerabilities. The vendor recommends performing the update using the same administrator account used in the previous installation and with elevated privileges.

Before updating, the vendor recommends backing up the registry configuration and saved hosts from Dameware Remote Support (DRS 12.2.4 or later) and Mini Remote Control (MRC 12.2.2 or later), due to changes in the protection of saved hosts.

Version 2026.3.1 also fixes a DLL hijacking vulnerability (CVE-2026-28327, CVSSv3.1 8.2) that can only be exploited during installation and requires local access with administrator privileges, and updates two third-party components: Brotli (CVE-2026-111497, CVSSv3.1 9.8), which has been included in catalogs of known exploited vulnerabilities since Oct 27, 2026, and Apache Log4net (CVE-2026-40021, CVSSv3.1 6.3).

For information on how to update, visit the following link:

https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28336

Additional information: