CVE-2026-9226: Devolutions Server vulnerability

Q: Which deployments are exposed?

Devolutions Server deployments using the Azure AD external login flow are affected if they run version 2026.3.7.0 or earlier.

Q: What does an attacker need to exploit this issue?

The attacker needs a captured login-session token that was exposed in a redirect URL. The issue can then be exploited remotely to take over the associated user's account.

Published Oct 6, 2026

Updated

Authentication bypass in the Azure AD external login flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account via replay of a captured login-session token exposed in a redirect URL.

Affected Software

1 affected component

Devolutions Server<=2026.3.7.0

Event History

Oct 6, 2026

CVE Published

via MITRE·06:17 PM

Data Sourced

via MITRE·06:17 PM

DescriptionWeakness

Frequently Asked Questions

Which deployments are exposed?

Devolutions Server deployments using the Azure AD external login flow are affected if they run version 2026.3.7.0 or earlier.

What does an attacker need to exploit this issue?

The attacker needs a captured login-session token that was exposed in a redirect URL. The issue can then be exploited remotely to take over the associated user's account.

CVE-2026-9226: Devolutions Server vulnerability

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?