SolarWinds Dameware Command Injection Vulnerability (CVE-2026-28336)

Key facts for Dameware command injection flaw

Detection coverage for Dameware command injection flaw

As of 2026-11-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5211 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Dameware Agent DWRCS.exe Spawning Shell or Script Host (CVE-2026-28336 Command Injection)

Detects a command interpreter or script host (cmd.exe, powershell.exe, pwsh.exe, wscript.exe, cscript.exe, mshta.exe) created as a direct child of the Dameware Mini Remote Control agent DWRCS.exe. CVE-2026-28336 is an authenticated command injection (CVSS 9.9, CWE-20) in Dameware 2026.3 and earlier that leads to compromise of the remotely controlled host. The injection parameter is not public, so this behaviour-first hunt keys on the expected result of exploitation, a shell under the agent service process. It is a hunting hypothesis derived from the vulnerability class, not from a reported exploit; no in-the-wild exploitation is known as of 2026-11-04.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1210, T1059, T1059.001, T1059.003, T1078
• Data sources: sysmon, windows_process_creation
• Severity: high
• Confidence: medium

Splunk SPL

index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage="*\\DWRCS.exe" (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\mshta.exe")
```comment: Sysmon EventCode 1 process creation. DWRCS.exe is the DameWare Mini Remote Control agent service listening on TCP 6129. A shell child is the expected outcome of CVE-2026-28336 command injection but also of legitimate remote shell use, so triage by account and command line.```
| stats count min(_time) as first_seen max(_time) as last_seen values(User) as users values(CommandLine) as command_lines values(ParentCommandLine) as parent_command_lines by Computer ParentImage Image
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "DWRCS.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "mshta.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256
| order by Timestamp desc

Sigma

title: Dameware Agent DWRCS.exe Spawning Shell or Script Host
id: 3f6a2c14-5211-4b8e-9d01-7a1c0e5b2d11
status: experimental
description: Detects cmd, PowerShell, WSH or mshta started directly by the Dameware Mini Remote Control agent DWRCS.exe, the expected result of CVE-2026-28336 authenticated command injection. Hunting hypothesis, no public exploit exists.
references:
    - https://www.solarwinds.com/trust-center/security-advisories/cve-2026-28336
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-04
tags:
    - attack.execution
    - attack.t1059
    - attack.t1059.001
    - attack.t1059.003
    - attack.lateral_movement
    - attack.t1210
    - cve.2026.28336
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\DWRCS.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
    condition: selection
falsepositives:
    - Legitimate administrator use of the Dameware remote command or shell feature
    - Software deployment or remediation scripts launched through Dameware by help desk staff
level: high

Known false positives:

• Help desk or administrators legitimately using Dameware remote shell or command features spawn cmd.exe or powershell.exe under DWRCS.exe
• Automated patching or remediation scripts pushed through Dameware Remote Support

Tuning notes: Baseline the Dameware hosts and accounts that normally launch shells, then suppress by Computer and User. Raise priority when the host is not in the approved Dameware inventory, the installed version is 2026.3 or earlier, the shell runs as SYSTEM with encoded or download commands, or the event follows an off-hours Dameware authentication. Requires Sysmon EventCode 1 with ParentImage populated; adjust the index name to your Sysmon index. This is a hunting hypothesis, not a confirmed exploit signature.

• 🔒 Dameware Agent [indicator] Spawning LOLBins or Encoded and Download-Cradle Commands · unlock with TL Creds
• 🔒 Dameware Binaries Loading DLLs From Non-Standard Locations (DLL Hijacking, CVE-2026-28327 Class) · unlock with TL Creds
• 🔒 Dameware Agent [indicator] Accepting Connections on TCP 6129 From Non-Internal Addresses · unlock with TL Creds
• 🔒 Dameware [indicator] Command-Line Connection With Embedded Credentials · unlock with TL Creds
• 🔒 DLL Written Into Dameware Install Directory by Non-Installer Process · unlock with TL Creds
• 🔒 Dameware Mini Remote Control Agent Service Installed on Host · unlock with TL Creds
• 🔒 Post-Exploitation Persistence or Account Creation Under Dameware Agent Process Tree · unlock with TL Creds
• 🔒 Dameware Console [indicator] Fan-Out to Many Agents on TCP 6129 · unlock with TL Creds

Indicators of compromise for Dameware command injection flaw

As of 2026-11-04, Threadlinqs Intelligence tracks 7 indicators of compromise for TL-2026-5211.

How Dameware command injection flaw works

SolarWinds published advisory CVE-2026-28336 on 2026-11-03 describing a command injection vulnerability in SolarWinds Dameware that 'could lead to the compromise of the remotely controlled host'. Exploitation requires authentication. Dameware 2026.3 and all earlier versions are affected, and the fix ships in Dameware 2026.3.1, a security-only release with no new features or improvements. The release covers Dameware Mini Remote Control (MRC, 32-bit and 64-bit), Dameware Remote Support (DRS) and Dameware Central Server.

The CVSS 3.1 vector published by SolarWinds and NVD is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (9.9 Critical). The Scope:Changed metric reflects that impact extends beyond the vulnerable component to the remotely controlled host. NVD (published 2026-11-03 17:18 UTC, last modified 20:34 UTC the same day) maps the flaw to CWE-20 (Improper Input Validation) and supplies no CPE configuration; the vendor advisory does not specify a CWE. GBHackers prints the vector with a 'CVSS:3.0' prefix, but the vendor and NVD both score it under 3.1 and the metric values are identical. The vulnerable code path, injection parameter and exploit primitive have not been publicly disclosed. GBHackers stresses that this is not a disclosed authentication bypass, although a low-privilege account is sufficient. The vulnerability was reported by Greg Bernatowicz of the Boeing Enterprise Security Red Team.

The 2026.3.1 release notes also address CVE-2026-28327 (DLL hijacking, 8.2 High; occurs during installation only and needs local access with admin privileges), CVE-2026-28335 (buffer overflow that can enable remote code execution, authentication required, 8.4 High), CVE-2026-111497 (Google Brotli decoder buffer overflow, 9.8 Critical, third-party, affects Brotli 1.0.3 through 1.2.0 and is fixed in 1.0.10, 1.1.1 and 1.2.1) and CVE-2026-40021 (Apache log4net failing to sanitize characters forbidden by XML 1.0 in MDC properties, 6.3 Medium, third-party). Because the fixes ship together, defenders should treat 2026.3.1 as a single mandatory upgrade covering all of them. Release notes also state that versions 12.3, 12.3.1 and 12.3.2 reach End-of-Engineering on 2026-06-30 and End-of-Life on 2027-06-30, and that DRS 12.2.4+ and MRC 12.2.2+ upgrades require backing up registry settings and saved hosts first.

No workaround is listed in the advisory. GBHackers recommends inventorying Dameware deployments, upgrading to 2026.3.1 as a priority, restricting remote administration access to trusted networks, reviewing account privileges and monitoring for unexpected commands or processes related to remote support activity. Dameware agents (DWRCS.exe) listen on TCP 6129 by default, so exposure of that port and credential hygiene for accounts able to authenticate to Dameware are the main risk-reduction levers until patching completes. Dameware has a history of vulnerabilities, including CVE-2025-26396 (local privilege escalation via incorrect permissions in the Mini Remote Control Service, CVSS 7.8, fixed in 12.3.2, reported by Alexander Pudwill via Trend Micro ZDI), which makes it a recurring target class for defenders to monitor. No exploitation in the wild has been reported as of 2026-11-04, and no SolarWinds Dameware CVE was found in the CISA KEV catalog.

MITRE ATT&CK techniques by tactic:

Execution

T1059 Command and Scripting Interpreter

Initial Access

T1078 Valid Accounts

Command and Control

T1219.002 Remote Desktop Software

stealth

T1574.001 DLL

Remediation for Dameware command injection flaw

Patches

• SolarWinds Dameware 2026.3.1 (also fixes CVE-2026-28327, CVE-2026-28335, CVE-2026-111497, CVE-2026-40021)

Immediate actions

• Upgrade SolarWinds Dameware (MRC, DRS, Central Server) to 2026.3.1 or later
• Restrict remote administration access (Dameware agent TCP 6129) to trusted management networks
• Review and reduce privileges of accounts that can authenticate to Dameware
• Inventory all Dameware deployments and record installed versions

Workarounds

• No vendor workaround published; limit network exposure and account privileges until patched

Longer-term hardening

• Alert on unexpected child processes spawned by DWRCS.exe and DWRC.exe
• Enforce MFA and least privilege for remote administration tooling
• Plan migration off 12.3.x branches before End-of-Life on 2027-06-30
• Back up registry settings and saved hosts before upgrading DRS 12.2.4+ and MRC 12.2.2+

Affected and fixed versions

• SolarWinds — Dameware (Mini Remote Control, Remote Support, Central Server)
  Vulnerable versions: 2026.3 and all earlier versions
  Fixed in: 2026.3.1

Timeline of Dameware command injection flaw

• 2025-06-02 SolarWinds released Dameware Mini Remote Control 12.3.2, fixing the earlier local privilege escalation CVE-2025-26396 (CVSS 7.8, incorrect permissions in the MRC service), illustrating a recurring vulnerability class in the product.
• 2025-06-03 CVE-2025-26396 publicly reported, crediting Alexander Pudwill via Trend Micro Zero Day Initiative.
• 2026-06-30 Dameware 12.3, 12.3.1 and 12.3.2 reached End-of-Engineering per the 2026.3.1 release notes; End-of-Life follows on 2027-06-30.
• 2026-11-03 CVE-2026-28336 published in NVD at 17:18 UTC with CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H and CWE-20; last modified at 20:34 UTC the same day.
• 2026-11-03 Dameware 2026.3.1 released as a security-only update fixing CVE-2026-28336, CVE-2026-28327, CVE-2026-28335, CVE-2026-111497 and CVE-2026-40021.
• 2026-11-03 SolarWinds published security advisory CVE-2026-28336 (CVSS 9.9) for an authenticated command injection in Dameware 2026.3 and earlier, crediting Greg Bernatowicz of the locked-ioc-1.
• 2026-11-04 GBHackers reported the vulnerability and recommended inventory, upgrade, network restriction and privilege review; no in-the-wild exploitation, public PoC or IOCs were stated.
• 2027-06-30 Scheduled End-of-Life for Dameware 12.3, 12.3.1 and 12.3.2 per vendor release notes.

Sources cited for Dameware command injection flaw

• SolarWinds Security Advisory CVE-2026-28336 solarwinds.com · Advisory · 2026-11-03
• NVD - CVE-2026-28336 NVD (NIST) · Advisory · 2026-11-03
• CISA Known Exploited Vulnerabilities Catalog CISA · Government advisory
• Dameware 2026.3.1 Release Notes documentation.solarwinds.com · Vendor report · 2026-11-03
• Dameware stand-alone installation port requirements documentation.solarwinds.com · Vendor report
• Use command line to run Dameware Mini Remote Control documentation.solarwinds.com · Vendor report
• Tenable PVS Plugin 2829 - DameWare Remote Desktop Listener Tenable · Research
• Critical SolarWinds Dameware Vulnerability Enables Attackers to Take Control of Remote Systems gbhackers.com · News · 2026-11-04
• SolarWinds Dameware vulnerability (CVE-2025-26396) - Cyber Security News cybersecuritynews.com · News · 2025-06-03

More in vulnerability

• CVE-2026-25599: Missing Authentication, Clear-Text Transmission and Stored XSS in Orca Heat Pumps and Orca User Portal
• CVE-2026-25600: Hard-coded Cryptographic Secret in Trac d.o.o. PDBM (Process Database Manager) 1.0.0.0 Enables Administrative Credential Decryption
• Microsoft Analysis: 78% of Exploited Vulnerabilities Enable System Takeover and Privilege Escalation
• Android November 2026 Security Bulletin: Over 200 Vulnerabilities Patched, Including Critical Framework RCE (CVE-2026-58868)
• Docker Sandboxes (sbx CLI) Symlink Vulnerability Lets AI Agents Read/Write Host Files Outside Sandbox (CVE-2026-103916)