Critical Command Injection Vulnerability in SolarWinds Dameware Enables Remote System Compromise
SolarWinds has published an advisory on November 3, 2026, detailing CVE-2026-28336, a critical command injection vulnerability in Dameware that carries a CVSS score of 9.9 out of 10.
Dameware is the company’s remote support solution used by IT teams to take control of workstations. The flaw permits an authenticated user to execute commands and fully compromise the remote machine being supported.
Command injection occurs when software receives user input and forwards it to the operating system without validating the content. What should be treated as data is instead interpreted as an instruction, allowing an attacker to append their own commands to those the program would normally execute.
The attack vector recorded by SolarWinds is network-based, with low complexity and no user interaction required. The only prerequisite is possession of a valid Dameware account, even one with low privileges, making the issue reachable by any support operator or anyone who has obtained such credentials.
The CVSS scope change significantly expands the impact: the vulnerability affects not only the vulnerable component but also the remote machine controlled by the tool, with high confidentiality, integrity, and availability impacts. In a support environment, a standard account can be converted into privileged access on attended endpoints.
Credit for the discovery goes to Greg Bernatowicz of the Boeing Enterprise Security Red Team. No malware has been linked to the flaw, and the advisory reports no ongoing attacks, placing the update in a preventive rather than incident-response context.
Affected versions include Dameware 2026.3 and all earlier releases. The fix is included in version 2026.3.1. This is not the first security issue addressed in the product: a privilege escalation vulnerability in the same software was resolved in 2025, and in July SolarWinds released patches for fifteen vulnerabilities in Serv-U.
Organizations are advised to update to 2026.3.1 immediately and, at the same time, review the list of Dameware accounts to remove any that are no longer in use. Limiting network access so the console is reachable only from administrative networks reduces the attack surface. Reviewing logs for unusual commands provides additional verification in environments where the product remains exposed.
Related articles
sshhole: OpenSSH Authentication Bypass on musl libc Systems Without PAM
An emergency patch for OpenSSH 10.6p2 was released on November 5, 2026, to fix a critical authentication bypass vulnerability affecting Linux systems using musl libc without PAM support. The flaw allowed attackers to log into accounts with a locked password by supplying any string longer than 256 bytes. The root cause traces back to a chain of engineering decisions: musl's crypt() returning '*' on length errors instead of NULL, OpenSSH's 2016 timing attack mitigation that selected salts from real hashes, and the resulting strcmp match between error result and the shadow '*' marker. Exploitation required a specific combination of musl, OpenSSH without PAM, password authentication enabled, and an account marked with '*' in /etc/shadow, notably impacting Alpine Linux cloud images. The vulnerability was discovered by researcher Özgün Kültekin using LLM-assisted fuzzing of 17,600 authentication variants. OpenSSH 10.6p2 or equivalent distribution patches close the issue; until applied, administrators should set PasswordAuthentication no where password login is unnecessary.
GhostMap Vulnerability Forces Android Devices into Unrecoverable Boot Loops
Bitdefender researchers have identified GhostMap, a vulnerability that causes system_server to crash repeatedly when processing a specially crafted APK file. The flaw stems from inconsistent handling of ZIP archive parameters across Android system libraries, allowing a malformed resource to trigger an infinite reboot cycle. No code execution or permissions are required; the malicious APK only needs to be present on the device. The issue affects devices running Android 10 and later, with successful reproduction demonstrated on a Pixel device running Android 17 and the August 2026 security patch. Safe mode fails to interrupt the loop, and recovery often requires a factory reset that erases local data. Google initially closed the report as unreproducible before reassigning it to the appropriate team for potential future remediation.
CISA Adds Apple CVE-2024-27834 to Known Exploited Vulnerabilities Catalog After Confirmed Exploitation
The U.S. Cybersecurity and Infrastructure Security Agency has added the Apple vulnerability CVE-2024-27834 to its Known Exploited Vulnerabilities catalog following confirmed in-the-wild exploitation. The flaw impacts multiple Apple platforms including iOS, iPadOS, macOS, Safari, tvOS, and watchOS. It is an authentication bypass issue that can be exploited for arbitrary read and write operations when an attacker already possesses initial access rights. The vulnerability was discovered and patched in 2024, yet exploitation activity has now prompted federal action. NIST rates the issue at CVSS 5.5 Medium. U.S. federal agencies are required to apply mitigations by November 18.
Ruby on Rails Releases Security Updates Fixing 21 Vulnerabilities Including Critical Active Storage Flaw
The Ruby on Rails development team has issued security updates for versions 8.1.4.1 and 8.0.5.2 that address a total of 21 vulnerabilities. One issue rated critical affects the Active Storage component when ImageMagick is used for image processing. The flaw tracked as CVE-2026-122006 carries a CVSS v3.1 base score of 9.8 and could allow arbitrary file writes or data exfiltration from untrusted uploads. Additional high-severity problems enable remote code execution, arbitrary file reads, parameter validation bypass, IP spoofing, cross-site scripting, and denial-of-service conditions. The 8.0 branch will reach end of security support on November 7, 2026, after which no further fixes will be provided. Administrators are strongly advised to apply the patches immediately.