CVE-2026-114487: Devolutions Devolutions Server vulnerability

Q: Who can exploit this issue?

An authenticated non-administrative user who has a PAM license can exploit the affected import endpoint. The issue is limited to creating PAM sub-providers under existing Active Directory providers.

Q: What access or setup is required before exploitation?

The attacker needs valid authentication, a PAM license, and an existing AD provider to target. Exploitation is performed by sending a crafted PAM AD computer import request.

Q: Which releases are affected?

Affected releases are Devolutions Server 2026.3.5.0 through 2026.3.10.0, plus 2026.2.20.0 and earlier.

Published Oct 22, 2026

Updated

Missing authorization in the PAM AD computer import endpoint in Devolutions Server 2026.3.5.0 through 2026.3.10.0 and 2026.2.20.0 and earlier allows an authenticated non-administrative user with a PAM license to create PAM sub-providers under existing AD providers via a crafted import request.

Affected Software

1 affected component

Devolutions Devolutions Server>=2026.3.5.0<=2026.3.10.0, <=2026.2.20.0

Event History

Oct 22, 2026

CVE Published

via NVD·04:17 PM

Data Sourced

via NVD·04:17 PM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated non-administrative user who has a PAM license can exploit the affected import endpoint. The issue is limited to creating PAM sub-providers under existing Active Directory providers.

What access or setup is required before exploitation?

The attacker needs valid authentication, a PAM license, and an existing AD provider to target. Exploitation is performed by sending a crafted PAM AD computer import request.

Which releases are affected?

Affected releases are Devolutions Server 2026.3.5.0 through 2026.3.10.0, plus 2026.2.20.0 and earlier.