A critical vulnerability, identified as CVE-2025-26396, affects the SolarWinds Dameware Mini Remote Control and could allow attackers to gain privilege escalation on vulnerable systems.
See also: SolarWinds XSS vulnerability allows malware insertion
Security researcher Alexander Pudwill, in collaboration with the Trend Micro Zero Day Initiative, responsibly disclosed the vulnerability to SolarWinds. As part of a coordinated vulnerability disclosure, SolarWinds has released Dameware version 12.3.2, which fixes this critical security flaw.
The CVE-2025-26396 results from a misconfiguration of permissions in Dameware Mini Remote Control , creating the potential for local privilege escalation .
This is specifically a privilege, which allows malicious users to gain access beyond the permitted limits by exploiting the service's privilege structure.
The vulnerability requires specific conditions to be successfully exploited. Attackers must have local access to the target system and a valid account with limited privileges.
See also: SEC: Accuses companies of misleading investors – How the SolarWinds hack is related
This limitation means that remote exploitation is not possible without prior compromise of the system, which limits the attack surface to some extent.
However, the high severity of the vulnerability reflects the significant impact it can have when these conditions are met. At a technical level, the vulnerability is related to incorrect access control mechanisms in the Dameware service structure.
When a user with limited privileges interacts with the service, incorrect permission settings allow unauthorized elevation of privilege, which may lead to administrative access to system resources and sensitive data.
Organizations using Dameware version 12.3.1 or earlier are vulnerable to this elevation of privilege attack. The vulnerability affects the remote control service core, which is a key component of Dameware's remote management capabilities. System administrators should immediately assess their existing Dameware deployments to identify potential exposure.
See also: CISA: Adds SolarWinds WHD vulnerability to KEV List
SolarWinds released Dameware version 12.3.2 on June 2, 2025 , as a targeted security update that addresses this critical vulnerability. In addition to the core security fix, the update also includes several additional improvements .
Source: cybersecuritynews
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
