CVE-2026-110804: devolutions devolutions_server

CVSS 4.3 (medium) · published 2026-10-16

Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with PAM checkout access to delete arbitrary Active Directory groups or retain elevated privileges via client-supplied JIT elevation settings in a checkout update request.

Affected products (NVD): devolutions devolutions_server

Fixed in (NVD): 2026.2.20.0, 2026.3.10.0

Weakness: CWE-915

Source: NVD CVE-2026-110804

References

• https://devolutions.net/security/advisories/DEVO-2026-0036/

Check your software

Connect an AI agent to the Fixlane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.