CVE-2026-119636
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
A vulnerability in Devolutions Server (versions 2025.3.2.0 through 2026.2.22.0) causes improper release of expired privileged access checkouts in the PAM scheduled check-in task. An authenticated user with checkout rights on a PAM account can retain access to that account on the target system after the checkout expires if a backlog of 21 or more newer active checkouts prevents the expired checkout from being checked in and its password from being rotated.
Risk Assessment
A user with checkout rights can maintain access to a privileged account after the checkout expires, violating access control and potentially enabling unauthorized actions on the target system. The lack of password rotation increases the risk of credential misuse.
Recommendation
Update Devolutions Server to a version later than 2026.2.22.0 that fixes this vulnerability. Until patched, monitor PAM checkout queues and limit the number of concurrent active checkouts.
Other vulnerabilities in Devolutions Server
See all- CVE-2026-93330Medium
In Devolutions Server 2026.3.5, improper rule enforcement in the PAM Active Directory provider allows a user with PAM edit permissions to bypass the Devolutions Gateway host ruleset.
- CVE-2026-100289Medium
In Devolutions Server 2026.3.5.0 and earlier, missing authorization in the gateway network scan token API allows an authenticated low-privileged user to generate a network scan token and perform internal network discovery and port scanning through the gateway via a crafted API request.
- CVE-2026-100287Medium
In Devolutions Server 2026.3.5.0 and earlier, missing authorization in the attachment history API allows an authenticated low-privileged user to permanently delete or restore vault attachments via a crafted API request.
- CVE-2026-100286Medium
In Devolutions Server 2026.3.5.0 and earlier, missing authorization in the data source settings API allows an authenticated non-administrative user to disclose integration secrets via a crafted API request.
- CVE-2026-121580High
Server-side request forgery in the Jira ticketing filter lookup in Devolutions Server 2026.2.22.0 and earlier allows an authenticated low-privileged user to obtain the stored Jira service account credentials via an attacker-controlled server address in the request.
- CVE-2026-120734Medium
Cleartext transmission of sensitive information in the email configuration test in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with access to the test action to obtain the stored SMTP password via a request that names an attacker-controlled SMTP host.
- CVE-2026-120733High
Cleartext storage of sensitive information in the user account data in Devolutions Server 2026.3.12.0 and earlier allows an attacker with read access to the database or a database backup to obtain users' TOTP shared secrets via the unencrypted copy of the security key written when an administrator saves a user.
- CVE-2026-120716Medium
Insertion of sensitive information into sent data in the identity provider user synchronization in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with the delegated permission to update users from the identity provider to obtain other users' MFA secrets via the synchronization API response.
- CVE-2026-120715High
Server-side request forgery in the Active Directory credential validation in Devolutions Server 2026.3.12.0 and earlier allows an authenticated low-privileged user to capture the NetNTLMv2 hash of the DVLS service account via an attacker-controlled domain name in the request.
- CVE-2026-114487Medium
Missing authorization in the PAM AD computer import endpoint in Devolutions Server 2026.3.5.0 through 2026.3.10.0 and 2026.2.20.0 and earlier allows an authenticated non-administrative user with a PAM license to create PAM sub-providers under existing AD providers via a crafted import request.
Original NVD description (English source)
Improper release of expired privileged access checkouts in the PAM scheduled check-in task in Devolutions Server 2025.3.2.0 through 2026.2.22.0 allows an authenticated user with checkout rights on a PAM account to retain access to that account on the target system after the checkout expires via a backlog of 21 or more newer active checkouts that prevents the expired checkout from being checked in and its password from being rotated.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS