CVE-2026-14536
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
In Devolutions Server 2026.2.9.0, improper enforcement of a mandatory multi-factor authentication (MFA) policy was found. An attacker with valid user credentials can bypass the MFA Required policy and authenticate without completing multi-factor authentication. The issue occurs when DVLS encounters an invalid default MFA value.
Risk Assessment
The risk is that an attacker with stolen or guessed credentials can access the system without the second authentication factor, undermining core security and potentially leading to unauthorized access to sensitive data.
Recommendation
Immediately update Devolutions Server to a version where the MFA policy enforcement is fixed. Until the update, monitor authentication logs for unusual login attempts and temporarily strengthen other access control mechanisms.
Original NVD description (English source)
Improper enforcement of a mandatory multi-factor authentication policy in Devolutions Server 2026.2.9.0 allows an attacker with valid user credentials to bypass the MFA Required policy and authenticate without completing multi-factor authentication. The problem occurs when DVLS encounters an invalid default MFA value.