Threat video1:00
CVE-2026-28336 Dameware RCE: Exploitation Status & Fix
SolarWinds fixed Dameware's authenticated command injection in 2026.3.1; 9 detection rules, including a free Splunk SPL rule, cover it.
Read the full threat intel for CVE-2026-28336 Dameware RCE: Exploitation Status & Fix →
Chapters
- 0:00The hookCritical 9.9 command injection in Dameware Remote Control.
- 0:05The storySolarWinds disclosed command injection in Dameware.
- 0:12Attack pathReported by SolarWinds: a low-privilege account connects to Dameware and sends a command that could compromise the remote host.
- 0:25AttributionNo threat actor is attributed.
- 0:30Indicators of compromise4 indicators to hunt: 1 URL, 1 file name and 2 package names.
- 0:37MITRE ATT&CK techniques4 ATT&CK techniques, from initial access to command and control.
- 0:42Remediation4 steps now: Upgrade SolarWinds Dameware.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Critical 9.9 command injection in Dameware Remote Control.
0:06SolarWinds disclosed command injection in Dameware.
0:09A patch shipped the same day.
0:12Reported by SolarWinds: a low-privilege account connects to Dameware and sends a command that could compromise the remote host.
0:26No threat actor is attributed. Confidence: low.
0:304 indicators to hunt: 1 URL, 1 file name and 2 package names.
0:374 ATT&CK techniques, from initial access to command and control.
0:434 steps now: Upgrade SolarWinds Dameware.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.