CVE-2026-28336

CRITICAL 9.9

SolarWinds Dameware Command Injection Vulnerability

CVSS Score

9.9

EPSS Score

0.0%

EPSS Percentile

0th

SolarWinds Dameware was found to be affected by a command injection vulnerability that could lead to the compromise of the remotely controlled host. Authentication is required.

CWE	CWE-20
Vendor	solarwinds
Product	dameware
Published	Nov 3, 2026

Stay Ahead of the Next One

Get instant alerts for solarwinds dameware

Be the first to know when new critical vulnerabilities affecting solarwinds dameware are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

SolarWinds / Dameware

0 ≤ 2026.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

documentation.solarwinds.com: https://documentation.solarwinds.com/en/success_center/dameware/content/release_notes/dameware_2026-3-1_release_notes.htm solarwinds.com: https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28336

Credits

🔍 Greg Bernatowicz on the Boeing Enterprise Security Red Team