# SolarWinds Dameware command injection scored 9.9 (CVE-2026-28336), fixed in 2026.3.1 · pwn.watch

> SolarWinds published Dameware 2026.3.1 on Nov 3 2026 to fix three of its own CVEs. The worst is CVE-2026-28336, a command-injection bug rated CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H): an authenticated Dameware user can inject commands that compromise the remotely controlled host, not only the Dameware instance. The same release fixes CVE-2026-28335 (authenticated buffer overflow leading to RCE, 8.4) and CVE-2026-28327 (DLL hijacking during install, 8.2, needs local admin). Dameware 2026.3 and all earlier versions are affected. Upgrade to 2026.3.1; until then restrict who can authenticate to Dameware and block external access to its ports. No public exploitation reported at disclosure.

Page: https://pwn.watch/i/solarwinds-dameware-cve-2026-28336 · generated 2026-11-04T14:30:54.317Z

## Status
- Severity: critical · status: live · patch: patched
- Product: SolarWinds Dameware
- Started: 2026-11-03
- CVEs: CVE-2026-28336, CVE-2026-28335, CVE-2026-28327
- Affected: SolarWinds Dameware 2026.3 and all previous versions
- Fixed in: Dameware 2026.3.1

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/solarwinds-dameware-cve-2026-28336/feed.xml
- JSON Feed: https://pwn.watch/i/solarwinds-dameware-cve-2026-28336/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/solarwinds-dameware-cve-2026-28336.json
- This file: https://pwn.watch/i/solarwinds-dameware-cve-2026-28336/llms.txt

## Updates (newest first)
- 2026-11-03: SolarWinds releases Dameware 2026.3.1 and publishes the CVE-2026-28336 advisory (CVSS 9.9), plus CVE-2026-28335 and CVE-2026-28327; credits Greg Bernatowicz (Boeing Enterprise Security Red Team) and Luiz Felipe Mol. (https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28336)

## Fix brief
# Security brief: SolarWinds Dameware command injection scored 9.9 (CVE-2026-28336), fixed in 2026.3.1

Source: https://pwn.watch/i/solarwinds-dameware-cve-2026-28336 · status: live · severity: critical · updated Nov 4, 2026, 11:40 UTC

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
SolarWinds published Dameware 2026.3.1 on Nov 3 2026 to fix three of its own CVEs. The worst is CVE-2026-28336, a command-injection bug rated CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H): an authenticated Dameware user can inject commands that compromise the remotely controlled host, not only the Dameware instance. The same release fixes CVE-2026-28335 (authenticated buffer overflow leading to RCE, 8.4) and CVE-2026-28327 (DLL hijacking during install, 8.2, needs local admin). Dameware 2026.3 and all earlier versions are affected. Upgrade to 2026.3.1; until then restrict who can authenticate to Dameware and block external access to its ports. No public exploitation reported at disclosure.

Severity detail: CVE-2026-28336 CVSS 9.9 (scope changed); authenticated command injection on the remotely controlled host; no known exploitation at disclosure

- Product: SolarWinds Dameware
- CVE / advisory ids: CVE-2026-28336, CVE-2026-28335, CVE-2026-28327

## Affected versions
- SolarWinds Dameware 2026.3 and all previous versions

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- Dameware 2026.3.1

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Specific notes
Confirm the installed Dameware version. If it is 2026.3 or earlier, upgrade to 2026.3.1. Until then, block external access to Dameware ports and limit which accounts can authenticate. Review recent remote-session activity for unexpected commands.

## Latest updates
- Nov 3, 2026: SolarWinds releases Dameware 2026.3.1 and publishes the CVE-2026-28336 advisory (CVSS 9.9), plus CVE-2026-28335 and CVE-2026-28327; credits Greg Bernatowicz (Boeing Enterprise Security Red Team) and Luiz Felipe Mol.

## Advisories
- [SolarWinds Dameware Command Injection Vulnerability (CVE-2026-28336)](https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28336) (SolarWinds)
- [Dameware 2026.3.1 release notes](https://documentation.solarwinds.com/en/success_center/dameware/content/release_notes/dameware_2026-3-1_release_notes.htm) (SolarWinds)
- [NVD - CVE-2026-28336](https://nvd.nist.gov/vuln/detail/CVE-2026-28336) (NVD)

---
Machine-readable: https://pwn.watch/i/solarwinds-dameware-cve-2026-28336.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.