SolarWinds fixes critical Dameware flaw; Tanium patches Threat Response

SolarWinds fixes critical Dameware flaw; Tanium patches Threat Response

3 November 2026: SolarWinds has released Dameware 2026.3.1 to fix CVE-2026-28336, a command injection rated 9.9 Critical that could compromise the host being remotely controlled. The attacker needs to be authenticated. On the same day, 3 November, Tanium published TAN-2026-095 for CVE-2026-116650 (High, 7.5), which lets a Tanium user with Threat Response write permission run unauthorised code on Linux endpoints that use the quarantine package. Neither vendor offers a workaround, and neither reports attacks.

Not yet independently verified. Canada's Cyber Centre lists Dameware versions up to and including 2026.3.1 as affected, while SolarWinds names 2026.3.1 as the release with the fix; we follow SolarWinds. Neither vendor reports exploitation. We will update this when it can be confirmed, and remove this note.

Both products have reach by design. Dameware connects help-desk staff to the machines they support; Tanium Threat Response acts on every endpoint it manages. A flaw that turns a legitimate login into code on the far end lands on many machines at once.

Three Dameware fixes in one release

The 2026.3.1 release notes list:

• CVE-2026-28336, command injection that could compromise the remotely controlled host, authentication required, 9.9 Critical;
• CVE-2026-28335, a buffer overflow leading to remote code execution, authentication required, 8.4 High;
• CVE-2026-28327, DLL hijacking during installation only, needing local administrator rights, 8.2 High.

Greg Bernatowicz of the Boeing Enterprise Security Red Team reported the first two, and Luiz Felipe Mol the third. The release also updates third-party components, including the Google Brotli decoder for CVE-2026-111497 and Apache log4net for CVE-2026-40021.

Because the critical flaw needs an account, the people who can reach it are the technicians and service accounts already set up in Dameware. Organisations that let outside support providers log in to their Dameware console should count those accounts in.

Tanium's quarantine package on Linux

Tanium's flaw is narrower. The CVSS vector scores it as network-reachable but of high complexity and needing low privileges, with full impact on confidentiality, integrity and availability. The fixed releases are:

• 2025H1: Threat Response 4.9.480 (Update 27) and later;
• 2025H2: 4.12.353 (Update 17) and later;
• 2026H1: 4.17.333 (Update 10) and later.

Until the update is in, the list of who holds Threat Response write permission is the control that matters. Tanium lists no acknowledgements for the report.

Two tools, one review

Both fixes come down to who can log in. Remote-support and endpoint platforms collect powerful roles over the years, and the roles outlive the people. Our remote support software category lists 17 products and endpoint protection software seven.

Related on TrustList:

• BeyondTrust Remote Support flaw exploited as a zero-day since August

Sources

• SolarWinds: Dameware 2026.3.1 release notes (release date 3 November 2026), 3 November 2026
• Tanium: TAN-2026-095, unauthorized code execution in Threat Response, 3 November 2026
• Canadian Centre for Cyber Security: SolarWinds security advisory (AV26-1124), 4 November 2026