CVE-2026-12755: Input Validation

Q: What is the severity of CVE-2026-12755?

The severity of CVE-2026-12755 is classified as low.

Q: How do I fix CVE-2026-12755?

To fix CVE-2026-12755, ensure the software is updated to Devolutions Server version 2026.2.8.0 or later.

Q: What type of vulnerability is CVE-2026-12755?

CVE-2026-12755 is an improper input validation vulnerability.

Q: Who is affected by CVE-2026-12755?

Authenticated users with the UserGroupsView permission in Devolutions Server are affected by CVE-2026-12755.

Q: What are the risks associated with CVE-2026-12755?

CVE-2026-12755 allows potential exposure of PAM provider credentials to an attacker-controlled host.

Published Jun 25, 2026

Updated

Improper input validation in the PAM AD discovery endpoints in Devolutions Server 2026.2.4.0 through 2026.2.7.0 allows an authenticated user with the UserGroupsView permission to coerce server-side authentication to an attacker-controlled host, exposing PAM provider credentials as a NTLMv2 challenge-response, via a crafted DomainName parameter.

Affected Software

2 affected components

Devolutions Devolutions Server>=2026.2.4.0<=2026.2.7.0

Devolutions Devolutions Server>=2026.2.4.0<2026.2.9.0

Event History

Jun 25, 2026

CVE Published

via MITRE·01:12 PM

Data Sourced

via MITRE·01:12 PM

DescriptionWeakness

Data Sourced

via NVD·02:16 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-12755?

The severity of CVE-2026-12755 is classified as low.

How do I fix CVE-2026-12755?

To fix CVE-2026-12755, ensure the software is updated to Devolutions Server version 2026.2.8.0 or later.

What type of vulnerability is CVE-2026-12755?

CVE-2026-12755 is an improper input validation vulnerability.

Who is affected by CVE-2026-12755?

Authenticated users with the UserGroupsView permission in Devolutions Server are affected by CVE-2026-12755.

What are the risks associated with CVE-2026-12755?