SolarWinds o'zining Dameware dasturida jiddiy buyruq in'ektsiyasi zaifligini e'lon qildi, bu autentifikatsiyalangan hujumchilarga nazorat qilinadigan xostlarni masofadan buzib kirish imkonini berishi mumkin.
CVE-2026-28336 sifatida aniqlangan ushbu zaiflik CVSS balli 9,9 ga teng va Dameware 2026.3 va undan oldingi barcha versiyalarni ta'sir qiladi. Ushbu muammoni hal qilish uchun SolarWinds 2026.3.1 versiyasini chiqardi, ta'sirlangan o'rnatishlardan foydalanadigan tashkilotlar yangilashni ustuvor qilishlari kerak.
Sotuvchi 2026-yil 3-noyabrda o'z maslahatini e'lon qildi va zaiflikni aniqlagan Boeing Enterprise Security Red Team'dan Greg Bernatowiczni kreditladi.
Rasmiy xavfsizlik maslahatiga ko'ra, muvaffaqiyatli ekspluatatsiya xostni masofadan nazorat qilish imkonini berishi mumkin. Autentifikatsiya aniq talab qilinadi, bu masalani autentifikatsiyasiz kirish imkonini beradigan zaifliklardan ajratib turadi.
SolarWinds vektorni CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H sifatida ro'yxatga oladi. Ushbu metrikalar tarmoq orqali kirish mumkin bo'lgan, past hujum murakkabligi, past imtiyozlar talab qilinadigan va foydalanuvchi o'zaro ta'siri yo'q zaiflikni tavsiflaydi.
O'zgartirilgan doira belgilanishi ekspluatatsiya zaif xavfsizlik vakolatidan tashqari resurslarga ta'sir qilishi mumkinligini ko'rsatadi, maxfiylik, yaxlitlik va mavjudlik ta'sirlari esa har biri yuqori deb baholangan.
Autentifikatsiya talabi muhim chegaradir: bu e'lon qilingan autentifikatsiya chetlab o'tish emas. Shunga qaramay, past imtiyoz talabi himoyachilar faqat yuqori imtiyozli hisoblar uni ekspluatatsiya qilishi mumkin deb o'ylamasliklari kerakligini anglatadi.
SolarWinds zaif parametr, buyruq bajarish mexanizmi, ekspluatatsiya yuklamasi yoki ball berish ma'lumotlaridan tashqari aniq ruxsatlarni e'lon qilmagan.
Ushbu e'lon Dameware'dagi Mini Remote Control Service'dagi noto'g'ri ruxsatlar bilan bog'liq avvalgi imtiyoz oshirish zaifligi haqidagi xabarlardan keyin keldi. Ushbu alohida masala, CVE-2025-26396, mahalliy kirishni talab qildi va Dameware 12.3.2 da hal qilindi. Administratorlar ushbu tarixiy tuzatishlarni yangi buyruq in'ektsiyasi zaifligi va uning talab qilinadigan tuzatilgan relizidan ajratishlari kerak.
Tashkilotlar Dameware o'rnatishlarini inventarizatsiya qilishlari va ta'sirlangan o'rnatishlarni 2026.3.1 versiyasiga yangilashlari kerak. Qo'shimcha ehtiyot chorasi sifatida, xavfsizlik jamoalari masofaviy ma'muriyat kirishini ishonchli tarmoqlarga cheklashlari, hisob imtiyozlarini ko'rib chiqishlari va masofaviy qo'llab-quvvatlash faoliyati bilan bog'liq kutilmagan buyruqlar yoki jarayonlarni tekshirishlari kerak. Ushbu choralar tuzatishni to'ldiradi, sotuvchining tuzatishini almashtirmaydi.
SolarWinds Serv-U va Web Help Desk'ga ta'sir qiladigan bog'liq e'lonlar turli mahsulotlar va zaiflik sinflarini o'z ichiga oldi. Ularning tuzatishlari Dameware'ni tuzatmaydi, bu har bir mahsulot versiyasini alohida kuzatish zarurligini ta'kidlaydi.
Dameware maslahati ekspluatatsiya yovvoyi tabiatda sodir bo'lganini yoki buzilish ko'rsatkichlarini taqdim etmaganini bildirmaydi. Shuning uchun himoyachilar faol ekspluatatsiyani tasdiqlangan deb qabul qilmasliklari, zaiflikning jiddiyligi va potentsial xost buzilishiga asoslanib tuzatishni ustuvor qilishlari kerak.
SOC'ingizga tezkor hodisalarni to'xtatish uchun ogohlantirish kontekstini bering. 16K SOC'dan tahdid razvedkasini integratsiya qiling.
SolarWinds has announced a critical command injection vulnerability in its Dameware software that could let authenticated attackers remotely compromise controlled hosts.
This vulnerability, identified as CVE-2026-28336, has a CVSS score of 9.9 and affects Dameware version 2026.3 and all earlier versions. To address this issue, SolarWinds has released version 2026.3.1, which organizations using the affected installations should prioritize updating.
The vendor published its advisory on November 3, 2026, crediting Greg Bernatowicz of the Boeing Enterprise Security Red Team with discovering the vulnerability.
According to the official security advisory, successful exploitation could allow remote control of the host. Authentication is explicitly required, distinguishing this issue from vulnerabilities that permit unauthenticated access.
SolarWinds lists the vector CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. These metrics describe a network-accessible vulnerability with low attack complexity, low privileges required, and no user interaction.
The changed-scope designation indicates that exploitation can affect resources beyond the vulnerable security authority, while confidentiality, integrity, and availability impacts are each rated high.
The authentication requirement remains an important boundary: this is not a disclosed authentication bypass. Nevertheless, the low-privilege requirement means defenders should not assume that only highly privileged accounts could exploit it.
SolarWinds has not published the vulnerable parameter, command execution mechanism, exploit payload, or precise permissions needed beyond the scoring information.
The disclosure follows earlier coverage of a Dameware privilege escalation vulnerability involving incorrect permissions in the Mini Remote Control Service. That separate issue, CVE-2025-26396, required local access and was addressed in Dameware 12.3.2. Administrators should distinguish those historical fixes from the new command injection vulnerability and its required patched release.
Organizations should inventory Dameware deployments and upgrade affected installations to version 2026.3.1. As additional precautions, security teams should restrict remote administration access to trusted networks, review account privileges, and investigate unexpected commands or processes associated with remote support activity. These measures supplement patching rather than replace the vendor’s fix.
Related disclosures affecting SolarWinds Serv-U and Web Help Desk involved different products and vulnerability classes. Their patches do not remediate Dameware, underscoring the need to track each product’s version independently.
The Dameware advisory does not state that exploitation has occurred in the wild or provide indicators of compromise. Defenders should therefore avoid treating active exploitation as confirmed, while prioritizing remediation based on the vulnerability’s severity and potential host compromise.
Give your SOC the alert context to stops incidents quickly.Integrate Threat Intel from 16K SOCs.
