Catch-up: SolarWinds has patched a critical flaw in its Dameware remote support software that could let a logged-in user take over a computer being controlled remotely. The fix was released on 3 November.

The flaw, tracked as CVE-2026-28336, is a command injection caused by improper input validation, and it carries a CVSS score of 9.9 out of 10. It affects Dameware 2026.3 and all earlier versions; the fixed version is Dameware 2026.3.1.

A login is required — but then the barrier falls

This is not an unauthenticated flaw. The attacker must already be logged in, although only low privileges are needed. From there, crafted input can inject commands that execute on the remotely controlled host, with the network-reachable, low-complexity, no-user-interaction profile reflected in the 9.9 score.

That boundary matters for how urgently teams should act. A flaw that needs a login is less exposed than one anyone on the internet can trigger — but Dameware is remote support software, used by help desks and outsourced support teams where many accounts legitimately hold access to other people's machines. A single compromised or malicious low-privilege account could turn that access into full control of a remote host.

Researcher credit, no exploitation reported

The flaw was reported by Greg Bernatowicz of the Boeing Enterprise Security Red Team, whom SolarWinds credits in its advisory. No exploitation in the wild and no public proof-of-concept have been reported, and the flaw is not on CISA's Known Exploited Vulnerabilities list.

SolarWinds has not published the vulnerable parameter, the command-execution mechanism or exact permissions beyond the CVSS scoring, so defenders cannot check for a specific exploit pattern. The practical step is the patch itself: any Dameware installation on 2026.3 or earlier should be updated to 2026.3.1, and support-desk accounts should hold only the access they genuinely need.

Sources: GBHackers, Critical SolarWinds Dameware vulnerability, 4 November 2026; CyberSecurityNews, Critical SolarWinds Dameware flaw, 4 November 2026; primary: SolarWinds security advisory, 3 November 2026.