SolarWinds Dameware is vulnerable to a DLL hijacking flaw that is triggered only during installation. The flaw allows an attacker who has local access to a machine and administrative privileges to place a malicious DLL in a location searched by the installer, causing the installer to load and execute the attacker’s code. This enables the attacker to gain elevated privileges or execute arbitrary code under the installer’s context, potentially compromising the confidentiality, integrity, and availability of the system. The weakness is a classic dynamic link library hijacking, classified as CWE‑427.

SolarWinds Dameware, all releases prior to version 2026.3.1, are affected. Users of any earlier Dameware version should assume the vulnerability is present until they upgrade to the recommended 2026.3.1 release or newer.

The vulnerability carries a CVSS score of 8.2, indicating a high severity impact for local privilege escalation. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires local access to a machine running the installer and requires that the attacker has administrative privileges to run the installer. Because the attack vector is local and confined to the installation process, the practical exploitation likelihood is moderate; however, if an attacker can gain such access they can elevate privileges or execute malicious code during installation. Users should treat this as a high‑risk local flaw that can be mitigated by patching the product.