CVE-2026-28336

Summary

SolarWinds Dameware contains a command injection vulnerability (CWE-20) allowing authenticated attackers to execute arbitrary commands on the remotely controlled host by injecting malicious input into an insufficiently sanitized parameter.

Exploitability

Exploitation requires valid authentication credentials and network access to the Dameware service, with no user interaction needed beyond initial login.

Blast radius

Successful exploitation grants full system compromise of the target host, enabling data theft, lateral movement, and persistent backdoor installation across the compromised environment.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to SolarWinds Dameware version 2.590 or later, as this is the first version that addresses CVE-2026-28336.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.