Skip to content
~/pwn.watch_

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

Become a sponsor

One slot: pwn.watch, gifs.so, flavors.design, kitze.io, every kitze repo, and an X shout-out.

YearlyBest value · save 44%$999/year$83.25/mo, billed yearly. Save $789 vs monthly (5+ months free).Monthly$149/monthBilled monthly. Cancel anytime.

Secure checkout on Polar. Right after paying you set up your ad on kitze.io.

← Live incidents
LivePatchedPatch now

SolarWinds Dameware command injection scored 9.9 (CVE-2026-28336), fixed in 2026.3.1

SolarWinds Dameware

Brought to you byTinkerer Club

The private club for people who own their servers, run their own AI, and pay $0/month for software.

SolarWinds published Dameware 2026.3.1 on Nov 3 2026 to fix three of its own CVEs. The worst is CVE-2026-28336, a command-injection bug rated CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H): an authenticated Dameware user can inject commands that compromise the remotely controlled host, not only the Dameware instance. The same release fixes CVE-2026-28335 (authenticated buffer overflow leading to RCE, 8.4) and CVE-2026-28327 (DLL hijacking during install, 8.2, needs local admin). Dameware 2026.3 and all earlier versions are affected. Upgrade to 2026.3.1; until then restrict who can authenticate to Dameware and block external access to its ports. No public exploitation reported at disclosure.

Why this severity: CVE-2026-28336 CVSS 9.9 (scope changed); authenticated command injection on the remotely controlled host; no known exploitation at disclosure

Started
Nov 3, 2026
CVEs
CVE-2026-28336CVE-2026-28335CVE-2026-28327

Follow this incident

Affected

  • SolarWinds Dameware 2026.3 and all previous versions

Fixed in

  • Dameware 2026.3.1

Timeline1

  1. SolarWinds releases Dameware 2026.3.1 and publishes the CVE-2026-28336 advisory (CVSS 9.9), plus CVE-2026-28335 and CVE-2026-28327; credits Greg Bernatowicz (Boeing Enterprise Security Red Team) and Luiz Felipe Mol.

Advisories3

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Sponsored

Buy sponsor slot · $149/mo