Dameware

Security incidents tagged Dameware. Newest first.

1 Dameware incident in the last 12 months

Critical 4 · High 3 · Med 2 · Low 1 · Update ½Severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½LessMore

Brought to you byTinkerer Club

The private club for people who own their servers, run their own AI, and pay $0/month for software.

Patched
SolarWinds Dameware command injection scored 9.9 (CVE-2026-28336), fixed in 2026.3.1
SolarWinds published Dameware 2026.3.1 on Nov 3 2026 to fix three of its own CVEs. The worst is CVE-2026-28336, a command-injection bug rated CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H): an authenticated Dameware user can inject commands that compromise the remotely controlled host, not only the Dameware instance. The same release fixes CVE-2026-28335 (authenticated buffer overflow leading to RCE, 8.4) and CVE-2026-28327 (DLL hijacking during install, 8.2, needs local admin). Dameware 2026.3 and all earlier versions are affected. Upgrade to 2026.3.1; until then restrict who can authenticate to Dameware and block external access to its ports. No public exploitation reported at disclosure.
SolarWinds DamewareSince Nov 3, 2026updated Nov 4, 2026, 11:40 UTC