EUVD-2026-116030Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local access to target host
-
DeliveryPlant malicious DLL in installer search path
-
ExploitAdministrator runs Dameware installer
-
ExecutionInstaller loads attacker DLL
-
ImpactExecute code with elevated privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V13 - Configuration Search path element control
|
| Exploitation Conditions | Exploitation is confined to the Dameware installation process only: the attacker must already have local access to the machine, must be able to write a malicious DLL into a directory that the installer searches at setup time, and a user or administrator must actually run the installer (UI:R). It is not exploitable against an already-installed or running Dameware instance, and it is not remotely reachable. Limiting factors: the local-access prerequisite, dependence on a victim launching the installer, and the installation-time-only window; note the description also cites 'admin privileges' as a precondition, which further narrows who can trigger it and is unresolved against the input's PR:L. |
| Impact | This is a locally-exploitable DLL hijacking flaw (CWE-427) scored CVSS 8.2, and the elevated score is driven by the full C:H/I:H/A:H impact plus the S:C scope change rather than ease of reach: the CVSS vector is AV:L (local), AC:L, PR:L, UI:R, meaning an attacker already needs local access and the installer must be run by a victim. There is no KEV listing and no EPSS value supplied, and no public exploit identified at time of analysis, so the real-world exploitation signal is weak despite the high base score. The vuln.today decision label is 'this_week', indicating a prompt-but-not-emergency priority consistent with a privilege-escalation issue that requires a local foothold and user action rather than remote mass exploitation. A key conflict exists: the description states the hijack 'requires access to the local machine and admin privileges', which, if taken literally as requiring pre-existing admin, would undercut the privilege-escalation value and argue for a higher PR than the input's PR:L - verify the exact privilege prerequisite with SolarWinds. Net: treat as a genuine but conditional local/escalation risk, not an internet-facing critical. |
| Exploit ScenarioDerived | A low-privileged local attacker plants a malicious DLL in a directory that the Dameware installer searches during setup, then waits for an administrator to run (or re-run) the installation. When the installer loads the attacker-controlled DLL, the code executes in the installer's elevated context, giving the attacker full compromise of the host. No public exploit code is identified at time of analysis, and exploitation is confined to the installation window. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
DLL hijacking in SolarWinds Dameware installers lets a local attacker who can write a malicious DLL into a location searched by setup execute code in the installer's context when a victim runs the installation. The issue is limited to installation time and is not exploitable against an already-installed or running Dameware instance; the CVSS 8.2 score reflects high confidentiality, integrity, and availability impact plus a scope change, not remote reachability. The vector requires local access and user action to launch the installer, and the description additionally cites admin privileges; no public exploit was identified at time of analysis.
RemediationAI
Apply the vendor fix documented in the SolarWinds advisory; the supplied references point to the Dameware 2026.3.1 release notes, but an explicit fixed-version boundary is not stated in the provided data, so verify the fixed build in the advisory before rollout. Because the assessed exploitation conditions require local write access to a directory searched by the installer and a victim running setup, restricting write permissions on installer directories and staging installers from trusted, access-controlled media addresses the stated prerequisite; this can interfere with installation workflows and does not replace the vendor fix. Run installers only from trusted sources and with the minimum privileges required, noting that the description cites admin privileges while the CVSS vector is PR:L. No public exploit was identified at time of analysis, and no other workaround is specified in the supplied data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-427, uncontrolled search path element, in the SolarWinds Dameware installation process. During setup, the installer loads a DLL from a directory that a local attacker can write to, so the attacker-supplied library runs in the installer's context; that is why the assessed vector includes S:C with C:H/I:H/A:H. The CVSS vector AV:L/AC:L/PR:L/UI:R confirms local access, low privileges per the vector, and required user action to launch the installer, while the description separately cites admin privileges as a precondition, which is unresolved against PR:L. Exploitation is confined to the installation process only and is not applicable to an already-installed or running Dameware instance. The supplied sources do not describe the trigger beyond DLL search-path hijacking during installation.
Know when Dameware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Local DLL plant (AV:L, PR:L) requires an admin/user to run the installer (UI:R); code runs in the elevated installer context crossing a privilege boundary (S:C) with full C/I/A impact.
Primary rating from Vendor (SolarWinds).
CVSS VectorVendor: SolarWinds
DescriptionCVE.org
SolarWinds Dameware was found to be affected by a DLL hijacking vulnerability. The hijack occurs during installations only and requires access to the local machine and admin privileges.
Executive ViewAI
The SolarWinds Dameware installer contains a DLL hijacking vulnerability (CVE-2026-28327) that could allow a local attacker with the ability to write a malicious DLL to execute code at installation time, but only if a victim subsequently runs the affected installer. This poses a high-impact but narrow threat: it does not affect already-installed or running Dameware instances, and requires both local write access and user action. Leadership should prioritize secure installation practices and developer remediation, as exploitation could lead to compromise of the installer's context with high confidentiality, integrity, and availability impact.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict installer execution to trusted administrators, run installers from write-protected media or directories, use application allowlisting to block unauthorized DLLs, and monitor for anomalous DLL creation in installer paths.
Threat Intelligence Overview
NVD
CVE.org
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Stack-based buffer overflow in dwrcs.exe in the dwmrcs daemon in SolarWinds DameWare Mini Remote Control 12.0 allows rem
Classic buffer overflow in SolarWinds Dameware allows a remote, unauthenticated attacker to cause a denial of service by
Dameware Remote Mini Control version 12.1.0.34 and prior contains a unauthenticated remote heap overflow due to the serv
Dameware Remote Mini Control version 12.1.0.34 and prior contains an unauthenticated remote buffer over-read due to the
Command injection in SolarWinds Dameware lets an authenticated attacker with low-privilege credentials execute arbitrary
Remote code execution in SolarWinds Dameware can be triggered by an authenticated low-privilege user who satisfies high-
GitHub PoC
Exploit-DB