Vulnerabilities · 9h ago

Dameware update covers flaws beyond its own code

INCIBE-CERT says SolarWinds Dameware 2026.3.1 fixes five security issues: three in Dameware and two in third-party components. The release addresses two critical, two high-severity and one medium issue; Dameware 2026.3 and earlier are affected.

One Dameware flaw is command injection that could let an authenticated attacker compromise a remotely controlled computer. Another issue is an overflow in Brotli, the decoder that unpacks compressed data: specially crafted input can corrupt memory during decoding, potentially exposing information, causing denial of service or enabling code execution.

For teams using Dameware to manage remote systems, the update’s scope includes third-party component flaws as well as issues assigned to Dameware. The advisories do not report exploitation.

CVE-2026-111497

NVD KEV

Known exploited · CISA KEV

CVSS 9.8 CRITICAL: a buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0… EPSS 83% (100th percentile). Microsoft patch: Release Notes.

Patch available KB5133964 Download →

CISA federal remediation date Nov 10

CVE-2026-28336

NVD KEV

CVSS 9.9 CRITICAL: solarWinds Dameware was found to be affected by a command injection vulnerability that could lead to the compromise of the remotely controlled host.

CVE-2026-28335

NVD KEV

CVSS 8.4 HIGH: solarWinds Dameware was found to be affected by a buffer overflow vulnerability that can result in remote code execution.

CVE-2026-28327

NVD KEV

CVSS 8.2 HIGH: solarWinds Dameware was found to be affected by a DLL hijacking vulnerability.

Timeline

Sources

2 sources covering this story

Entities

Part of the PlainSec briefing for 2026-11-04

Editions

Related stories