SolarWinds has issued an urgent patch for a command injection vulnerability in its Dameware remote support software that scores 9.9 out of 10 on the CVSS severity scale, just a hair below the maximum possible rating. The flaw, tracked as CVE-2026-28336, could let an attacker seize control of a computer that an IT technician is actively remote-controlling, turning a tool built to fix problems into one that creates them.

Why a Bug in a Help Desk Tool Matters This Much

Dameware is widely deployed by help desks and system administrators who need to connect into and troubleshoot remote machines, often with elevated access rights baked into the workflow. That combination of broad reach and strong privileges is precisely what makes a flaw like this one so dangerous: the same trust relationship that lets a technician fix a problem can, in the wrong hands, let an attacker ride along into the target system.

SolarWinds published its advisory on November 3, 2026, urging customers to update without delay. According to the company, no public exploitation has been reported and no malware campaign has yet been tied to the flaw, but given the severity score and the nature of the bug, that is unlikely to stay true for long once attackers take notice.

How the Flaw Works

Command injection vulnerabilities occur when software takes input from a user and passes it along to the underlying operating system without properly checking or sanitizing it first, giving an attacker a way to smuggle in commands of their own choosing. In this case, exploitation requires the attacker to already hold valid, authenticated access to the system, so it isn’t a flaw that lets a complete outsider walk in from the internet with zero credentials.

That said, the CVSS vector SolarWinds published, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, paints a picture of just how little else an attacker needs. The bug can be triggered over a network, requires only low attack complexity and low privileges, needs no interaction from a victim, and critically changes scope, meaning its impact doesn’t stay contained to the vulnerable component but can spread to the remote machine being managed. Confidentiality, integrity, and availability are all rated at the highest possible level, which is why the overall score lands so close to a perfect 10.

The vulnerability affects SolarWinds Dameware version 2026.3 and every version before it. SolarWinds has shipped version 2026.3.1 as the fix. Greg Bernatowicz of the Boeing Enterprise Security Red Team is credited with discovering and reporting the issue.

Not Dameware’s First Brush With Trouble

This isn’t the first time Dameware has drawn security scrutiny. An earlier privilege-escalation flaw in the product was patched back in 2025, and SolarWinds more broadly has had a busy stretch of vulnerability disclosures this year. The company recently patched critical remote-code-execution flaws in its Observability platform and pushed out fixes for 15 separate vulnerabilities in Serv-U back in July.

That pattern matters for a reason beyond SolarWinds’ own patch cadence: attackers have a documented history of targeting the company’s remote-support and help-desk tooling specifically. Security researchers have previously observed intruders exploiting flaws in SolarWinds’ Web Help Desk product to install additional remote-access tools once inside a network, a reminder that a single foothold in this category of software can cascade quickly across an organization’s IT estate.

What Administrators Should Do Now

• Upgrade Dameware to version 2026.3.1 as soon as possible; this is a drop-in fix rather than a mitigation workaround.
• Review who currently holds Dameware accounts and remove any that are no longer needed, since the flaw does require valid authentication to exploit.
• Restrict network access to the Dameware service to only the segments and personnel that genuinely need it.
• Monitor logs for unusual commands issued through remote-support sessions, which could indicate attempted exploitation even before a patch is fully rolled out.
• Treat remote-support and help-desk software generally as high-value targets in your patch-management prioritization, given its track record this year.

With a CVSS score this close to the ceiling and a public advisory now in circulation, the window between disclosure and the first exploitation attempts is likely to be short. Organizations running Dameware should treat this patch as a same-week priority rather than something to fold into a routine maintenance cycle.