CVE-2026-10544: OS Command Injection
Improper neutralization of special elements in the built-in PAM provider password rotation templates in Devolutions Server allows an authenticated user with write access to a vault to execute arbitrary commands on the systems managed by the affected PAM provider.
This issue affects :
Devolutions Server 2026.2.4.0 Devolutions Server 2026.1.20.0 and earlier
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict or remove write access to vaults in Devolutions Server to trusted administrators only; audit and revoke unnecessary write permissions for all users.
- Compensating control
Disable use of the built-in PAM provider password rotation templates or stop using the PAM provider's password rotation functionality in Devolutions Server until a vendor-supplied fix is available.
- Operational
Audit systems managed by the affected PAM provider for signs of compromise, review logs for commands executed via password rotation templates, and rotate any credentials or secrets that may have been exposed or could be impacted.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10544?
CVE-2026-10544 has a medium severity score of 6.5 according to the CVSS 3.1 metrics.
How do I fix CVE-2026-10544?
To fix CVE-2026-10544, ensure that you apply the latest security patches provided by Devolutions for Devolutions Server.
What systems are affected by CVE-2026-10544?
CVE-2026-10544 affects Devolutions Server installations where users have write access to a vault.
What kind of attack does CVE-2026-10544 enable?
CVE-2026-10544 allows authenticated users to execute arbitrary commands on systems managed by the affected PAM provider.
What vulnerability type is identified in CVE-2026-10544?
CVE-2026-10544 is classified as an OS Command Injection vulnerability.