SolarWinds Dameware Remote Support authenticated command injection

SolarWinds Dameware Remote Support / Mini Remote Control contains a command injection flaw (CWE-20). An authenticated low-privilege user who can reach the Dameware console can pass shell metacharacters through a parameter used in a remote session or administrative action; the unsanitized value is executed by the OS on the remotely controlled host, giving the attacker SYSTEM- or root-level code execution. Affected versions are 2026.3 and earlier; fixed in 2026.4.

SolarWinds rates this 9.9 CRITICAL with AV:N/PR:L/UI:N/S:C. That score presumes the Dameware console is network-reachable by a low-privileged account and that compromise of one remote host is a scope change. In most enterprise deployments the console sits on an internal management VLAN and requires valid low-privilege credentials — a real barrier. No public PoC, Metasploit/Exploit-DB/nuclei template, or in-the-wild exploitation has been observed as of 2026-11-03, so the vendor’s CRITICAL is too high for today’s exposure, but the post-auth blast radius is still severe.

Bottom line: Patch to 2026.4 on the noisgate remediation SLA (≤180 days for HIGH), and immediately restrict Dameware console/agent network paths and enforce MFA/least privilege on the noisgate mitigation SLA (≤30 days). Treat any low-priv Dameware account as a potential SYSTEM pivot.

Sources.

1. VulDB — CVE-2026-28336
2. CVE.org Record — CVE-2026-28336
3. Rapid7 Vulnerability Database — CVE-2026-28336
4. Mallory — Authenticated Command Injection in SolarWinds Dameware
5. OffSeq Threat Radar — CVE-2026-28336
6. Feedly — CVE-2026-28336

Run on any machine where SolarWinds Dameware Remote Support, Mini Remote Control, or Internet Session Agent is installed — central servers, admin workstations, and managed endpoints. Requires local administrator rights on the target host. Invoke from PowerShell as powershell -ExecutionPolicy Bypass -File check_dameware.ps1.

# check_dameware.ps1
# Checks installed SolarWinds Dameware versions against CVE-2026-28336
# Output: VULNERABLE (version <= 2026.3), PATCHED (>= 2026.4), UNKNOWN
# Exit: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN
$ErrorActionPreference = 'SilentlyContinue'
$paths = @(
  'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
  'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
)
$entries = foreach ($p in $paths) {
  Get-ItemProperty -Path $p -ErrorAction SilentlyContinue |
    Where-Object { $_.DisplayName -match 'Dameware' }
}
if (-not $entries) {
  Write-Output 'UNKNOWN'
  exit 2
}
$vulnerableFound = $false
$patchedFound = $false
foreach ($e in $entries) {
  $ver = $e.DisplayVersion
  if ($ver -and $ver -match '^(\d{4})(?:\.(\d+))?') {
    $year = [int]$Matches[1]
    $minor = [int]$Matches[2]
    if ($year -lt 2026 -or ($year -eq 2026 -and $minor -le 3)) {
      $vulnerableFound = $true
    }
    elseif ($year -gt 2026 -or ($year -eq 2026 -and $minor -ge 4)) {
      $patchedFound = $true
    }
  }
}
if ($vulnerableFound) { Write-Output 'VULNERABLE'; exit 1 }
elseif ($patchedFound) { Write-Output 'PATCHED'; exit 0 }
else { Write-Output 'UNKNOWN'; exit 2 }