CVE-2026-100289: Medium severity Devolutions Devolutions Server vulnerability
Missing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to generate a network scan token and perform internal network discovery and port scanning through the gateway via a crafted API request.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated low-privileged user of Devolutions Server can exploit it. The issue enables that user to generate a gateway network scan token through a crafted API request.
What access does exploitation provide?
Exploitation allows internal network discovery and port scanning through the gateway. It does not state that the attacker gains access beyond the ability to perform those scanning activities.
Which deployments are affected?
Devolutions Server 2026.3.5.0 and earlier is affected. The available information does not specify whether any particular default gateway configuration is required.