Dameware Command Injection Shows Why Remote Support Needs Its Own Boundary
SolarWinds released Dameware 2026.3.1 on November 3, 2026 with fixes for several CVEs. The most severe item in the vendor's SolarWinds CVE table is CVE-2026-28336, a command injection vulnerability rated 9.9 Critical. The vendor says authentication is required and successful exploitation could compromise the remotely controlled host.
The same release addresses CVE-2026-28335, a buffer overflow that can result in remote code execution with authentication, and CVE-2026-28327, a DLL hijacking issue that occurs during installation and requires local access plus administrator privileges.
The product is a high-value control plane
Dameware is used to reach and control endpoints. An attacker who can influence a remote-support operation may inherit the trust that administrators place in the tool. Authentication does not make that boundary safe if the authenticated role can reach a command execution path outside its intended scope.
The vendor's description does not provide a public proof of concept or a complete affected-version matrix in the release notes. Do not infer the exploit request shape from the severity score. Use the fixed release as the authoritative version boundary and consult SolarWinds support if an older deployment cannot be upgraded immediately.
Inventory the central and stand-alone cases
Dameware can be installed in centralized and stand-alone modes. The central server, administration console, Mini Remote Control clients, and saved host configuration may be managed by different teams. Inventory all of them.
Record the application version, installer type, service account, network listeners, and the identities allowed to initiate remote sessions. A standalone installation on an engineering workstation can be outside the central server's version report.
Reduce reach and privilege
Restrict remote-support traffic to approved administrative networks. Separate help-desk accounts from accounts that can install software or change service configuration. Require strong authentication and log every session, including the initiating user, target host, and session duration.
For installations that cannot be updated immediately, remove the host from direct internet reachability and limit who can authenticate. These controls do not fix the command injection. They reduce the number of identities that can reach it while the upgrade is scheduled.
Upgrade and investigate
Back up the SolarWinds configuration before upgrading, preserve saved hosts and registry settings, and install 2026.3.1 or a later supported release. Validate the central server and a representative endpoint before rolling out the change.
Review logs for unusual remote commands, sessions launched outside normal help-desk hours, and targets that do not match an approved ticket. A successful attacker may use a valid administrator session. Compare session logs with endpoint process creation and service changes.
If exploitation is suspected, isolate the control server and affected targets, preserve logs, rotate support credentials, and review remote-access tools for persistence. The control server is often a path to many endpoints, so a single host cleanup is not enough.
Top comments (0)