CVE-2026-114486: Devolutions Devolutions Server vulnerability
Incorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3.10.0 and earlier allows an authenticated non-administrative attacker to bypass the Network Access Rules of a virtual gateway and reach denied hosts via wildcard additional destinations signed into the gateway token.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated non-administrative attacker can exploit it. Administrative privileges are not required.
What access could an attacker gain through successful exploitation?
The attacker may bypass Network Access Rules configured on a virtual gateway and reach hosts that those rules deny.
What condition enables the bypass?
The issue involves wildcard additional destinations being signed into the Devolutions Gateway token, allowing them to be used to reach denied hosts.
Which deployments are affected?
Devolutions Server 2026.3.10.0 and earlier are affected when using a virtual gateway with Network Access Rules.