CERT-FR flags SolarWinds Dameware flaws
CERT-FR warns of multiple vulnerabilities in SolarWinds Dameware before version 2026.3 enabling remote code execution and security bypass.
Sourcecert.cyber.gouv.fr — open the original
What to check
- Applies to
- The 4 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-111497 as exploited in the wild.
CERT-FR issued an advisory covering multiple vulnerabilities in SolarWinds Dameware affecting versions prior to 2026.3. The flaws, tracked as CVE-2026-111497, CVE-2026-28327, CVE-2026-28335 and CVE-2026-28336, could allow an attacker to achieve remote code execution and bypass security policy controls. SolarWinds notes that Dameware Remote Everywhere is not affected by CVE-2026-111497, implying it may be impacted by the other listed CVEs or is a distinct product line.
No in-the-wild exploitation is mentioned in the advisory. Defenders running SolarWinds Dameware should consult the vendor's security bulletins for patch details and upgrade to version 2026.3 or later to remediate these issues.
Mentioned in this report
Detection guidance
Dameware Remote Control Named Pipes Created
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects creation of named pipes used by Dameware Mini Remote Control agent modules (remote shell, registry editor, clipboard, chat, terminal services helper), indicating Dameware remote session activity on the host. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Dameware Remote Control Named Pipes Created
id: a6532bad-0a1a-5ec2-93ad-47b9444cd38d
status: experimental
description: Detects creation of named pipes used by Dameware agent modules (remote
shell, registry editor helper, clipboard helper, direct chat, terminal services
helper). Indicates an active Dameware remote session on the host. Useful to spot
unauthorised use of Dameware, or activity on hosts running vulnerable Dameware versions
(prior to 2026.3). Does not detect exploitation of the CVEs themselves.
tags:
- attack.lateral-movement
- attack.t1021
logsource:
category: pipe_created
product: windows
detection:
selection:
PipeName:
- \TCRmtShellAgentModule_*
- \MSPARegEditHelper_*
- \MSPxTSHlpSrv_*
- \TCDirectChat_*
- \MSPAClipboardHelper_*
condition: selection
falsepositives:
- Authorised IT helpdesk or administrators using SolarWinds Dameware Mini Remote Control
for support sessions
level: low
author: Vorant
references:
- https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1459
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1459
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs