CVE-2026-9226: Medium severity Devolutions Server vulnerability
Published Oct 6, 2026
·Updated
Authentication bypass in the Azure AD external login flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account via replay of a captured login-session token exposed in a redirect URL.
Affected Software
1 affected component
Devolutions Server<=2026.3.7.0
Event History
Oct 6, 2026
CVE Published
via MITRE·06:17 PM
Data Sourced
via MITRE·06:17 PM
DescriptionWeakness
Data Sourced
via NVD·07:18 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are exposed?
Devolutions Server deployments using the Azure AD external login flow are affected if they run version 2026.3.7.0 or earlier.
2
What does an attacker need to exploit this issue?
The attacker needs a captured login-session token that was exposed in a redirect URL. The issue can then be exploited remotely to take over the associated user's account.