CVE-2025-26396: Dameware Mini Remote Control LPE Flaw

CVE-2025-26396 Overview

CVE-2025-26396 is a local privilege escalation vulnerability in SolarWinds Dameware Mini Remote Control. The flaw stems from incorrect permissions applied to product resources, which allows a user with a low-privilege local account to elevate to higher privileges on the affected host. The issue is tracked under CWE-269: Improper Privilege Management. SolarWinds addressed the vulnerability in Dameware Mini Remote Control 12.3.2. The vulnerability requires local access and valid credentials, so it is most relevant in post-compromise scenarios where an attacker seeks to move from a standard user context to SYSTEM.

Critical Impact
An authenticated local user can escalate privileges on hosts running vulnerable Dameware Mini Remote Control, resulting in full confidentiality, integrity, and availability impact.

Affected Products

SolarWinds Dameware Mini Remote Control versions prior to 12.3.2
Windows endpoints where Dameware Mini Remote Control is installed
Environments using Dameware for remote administration and helpdesk workflows

Discovery Timeline

2025-06-02 - CVE-2025-26396 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-26396

Vulnerability Analysis

The vulnerability resides in how SolarWinds Dameware Mini Remote Control applies access control to product files, directories, or services on the local system. When permissions are set too permissively, a low-privilege user can modify, replace, or influence resources that are later executed or loaded by a higher-privilege process. This class of flaw commonly manifests as writable service binaries, writable installation directories, or unquoted or hijackable service paths. The result is code execution in the context of a more privileged account, typically NT AUTHORITY\SYSTEM on Windows.

Root Cause

The root cause is improper privilege management ([CWE-269]). Access control lists on one or more Dameware components grant write or modify rights to non-administrative principals. This breaks the trust boundary between standard users and privileged services, because the privileged process ultimately consumes resources controlled by an unprivileged actor.

Attack Vector

Exploitation requires local access with a valid low-privilege account. No user interaction from another user is required. An attacker with an interactive session or a foothold obtained through phishing, malware, or stolen credentials replaces or modifies a Dameware-controlled resource. When the associated service starts or a privileged operation runs, the attacker-controlled payload executes with elevated rights. Public exploit code is not currently listed for CVE-2025-26396, and it is not present on the CISA Known Exploited Vulnerabilities catalog.

No verified proof-of-concept code is publicly available. Refer to the SolarWinds Security Advisory for CVE-2025-26396 for vendor-provided technical details.

Detection Methods for CVE-2025-26396

Indicators of Compromise

Unexpected modifications to files or directories within the Dameware Mini Remote Control installation path
New or altered binaries, DLLs, or scripts owned by a non-administrative user in privileged service directories
Dameware services starting processes whose image paths deviate from the vendor default
Creation of new local administrator accounts or scheduled tasks shortly after Dameware service activity

Detection Strategies

Monitor for write events to Dameware install directories originating from non-SYSTEM, non-admin principals
Alert on service configuration changes (ImagePath, ServiceDll) tied to Dameware components
Correlate low-privilege process activity with subsequent SYSTEM-level child processes spawned by Dameware services
Baseline the ACLs on Dameware directories and flag drift toward more permissive settings

Monitoring Recommendations

Enable Windows Security auditing for object access on the Dameware installation directory and service registry keys
Ingest Sysmon Event IDs 1 (process create), 7 (image load), and 11 (file create) filtered on Dameware paths
Track service start and stop events (Event ID 7045, 7040) for Dameware Mini Remote Control services
Review privileged logon events (Event ID 4672) for accounts that historically operate at standard-user level

How to Mitigate CVE-2025-26396

Immediate Actions Required

Upgrade SolarWinds Dameware Mini Remote Control to version 12.3.2 or later on all managed endpoints
Inventory all systems running Dameware Mini Remote Control and confirm build numbers post-upgrade
Restrict interactive logon rights on hosts where Dameware is installed to reduce the population of accounts that can attempt local exploitation
Rotate credentials on any host where suspicious privilege escalation activity is observed

Patch Information

SolarWinds resolved CVE-2025-26396 in Dameware Mini Remote Control 12.3.2. See the Dameware 12.3.2 Release Notes and the SolarWinds Security Advisory for CVE-2025-26396 for upgrade guidance and fixed build details.

Workarounds

If patching must be delayed, tighten NTFS permissions on the Dameware installation directory so only administrators and SYSTEM have write access
Disable the Dameware Mini Remote Control service on hosts where it is not actively required
Enforce least privilege by removing local administrator rights from standard users and helpdesk operators
Apply application allowlisting to prevent execution of unauthorized binaries from Dameware directories

bash

# Example: audit ACLs on the Dameware install directory (run from an elevated PowerShell)
Get-Acl "C:\Program Files\SolarWinds\DameWare Mini Remote Control 12" |
  Select-Object -ExpandProperty Access |
  Where-Object { $_.IdentityReference -notmatch "SYSTEM|Administrators|TrustedInstaller" }