CVE-2026-110804: Devolutions Devolutions Server vulnerability

Q: Who can exploit this issue?

An authenticated user must have PAM checkout access. The issue is not described as exploitable by unauthenticated users.

Q: What attacker capability is required?

The attacker needs to submit a checkout update request containing client-supplied JIT elevation settings. Successful exploitation can delete arbitrary Active Directory groups or allow the attacker to retain elevated privileges.

Q: Which versions are affected?

Devolutions Server 2026.3.8.0 and earlier are affected.

Published Oct 16, 2026

Updated

Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with PAM checkout access to delete arbitrary Active Directory groups or retain elevated privileges via client-supplied JIT elevation settings in a checkout update request.

Affected Software

1 affected component

Devolutions Devolutions Server<=2026.3.8.0

Event History

Oct 16, 2026

CVE Published

via MITRE·01:45 PM

Data Sourced

via MITRE·01:45 PM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated user must have PAM checkout access. The issue is not described as exploitable by unauthenticated users.

What attacker capability is required?

The attacker needs to submit a checkout update request containing client-supplied JIT elevation settings. Successful exploitation can delete arbitrary Active Directory groups or allow the attacker to retain elevated privileges.

Which versions are affected?

Devolutions Server 2026.3.8.0 and earlier are affected.