CVE-2026-12755
LowCVSS 2.7Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
A vulnerability in Devolutions Server versions 2026.2.4.0 through 2026.2.7.0 allows an authenticated user with the UserGroupsView permission to coerce server-side authentication to an attacker-controlled host. By crafting a DomainName parameter in the PAM AD discovery endpoints, the attacker can capture PAM provider credentials as an NTLMv2 challenge-response.
Risk Assessment
The risk involves leakage of sensitive PAM provider credentials, potentially leading to unauthorized system access and privilege escalation within the organization's IT environment.
Recommendation
Immediately upgrade Devolutions Server to version 2026.2.8.0 or later, which includes a fix for this vulnerability. Until the update is applied, restrict the UserGroupsView permission to trusted users only.
Other vulnerabilities in Devolutions Server
See all- CVE-2026-93330Medium
In Devolutions Server 2026.3.5, improper rule enforcement in the PAM Active Directory provider allows a user with PAM edit permissions to bypass the Devolutions Gateway host ruleset.
- CVE-2026-100289Medium
In Devolutions Server 2026.3.5.0 and earlier, missing authorization in the gateway network scan token API allows an authenticated low-privileged user to generate a network scan token and perform internal network discovery and port scanning through the gateway via a crafted API request.
- CVE-2026-100287Medium
In Devolutions Server 2026.3.5.0 and earlier, missing authorization in the attachment history API allows an authenticated low-privileged user to permanently delete or restore vault attachments via a crafted API request.
- CVE-2026-100286Medium
In Devolutions Server 2026.3.5.0 and earlier, missing authorization in the data source settings API allows an authenticated non-administrative user to disclose integration secrets via a crafted API request.
- CVE-2026-9226Medium
Authentication bypass in the Azure AD external login flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account via replay of a captured login-session token exposed in a redirect URL.
- CVE-2026-105488High
Missing authorization in the global vault in Devolutions Server 2026.3.7.0 and earlier allows an authenticated user with only the global vault view permission to modify and delete global contact and folder entries.
- CVE-2026-105485Medium
An authentication bypass in the OAuth device authorization flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account via replay of a captured device verification link by an authenticated victim.
- CVE-2026-93332Medium
Improper access control in the partial connection API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to read, create, modify, and delete System Vault entries via a crafted API request.
- CVE-2026-100288High
Devolutions Server 2026.3.5.0 and earlier stores sensitive information in cleartext in the database. An attacker with read access to the database can obtain external identity provider tokens and active session identifiers.
- CVE-2026-13327High
Improper certificate validation on LDAPS connections to Active Directory in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to intercept privileged directory service credentials via a spoofed domain controller certificate. The vulnerability enables a man-in-the-middle attack.
Original NVD description (English source)
Improper input validation in the PAM AD discovery endpoints in Devolutions Server 2026.2.4.0 through 2026.2.7.0 allows an authenticated user with the UserGroupsView permission to coerce server-side authentication to an attacker-controlled host, exposing PAM provider credentials as a NTLMv2 challenge-response, via a crafted DomainName parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS