Sicherheit & Compliance
Höchste Standards zum Schutz Ihrer Daten und zur Gewährleistung von Vertrauen.
DEVO-2026-0036
Devolutions Server is affected by multiple vulnerabilities.
Betroffene Produkte
Änderungsprotokoll
Initial publication - 2026-10-15
Incorrect authorization exposes add-on passwords
7.1 High - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with only View permission to obtain add-on passwords via the unredacted add-on properties returned in connection data.
CVE(s)
CVE-2026-110806
Behebung und Workarounds
Upgrade to Devolutions Server 2026.3.10 or higher, 2026.2.20.0 or higher.
Improperly controlled modification of JIT elevation settings in PAM checkout
6.4 Medium - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:H/SA:L
Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with PAM checkout access to delete arbitrary Active Directory groups or retain elevated privileges via client-supplied JIT elevation settings in a checkout update request.
CVE(s)
CVE-2026-110804
Behebung und Workarounds
Upgrade to Devolutions Server 2026.3.10 or higher, 2026.2.20.0 or higher.
Improper access control on asset contact password
5.3 Medium - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit asset permission to modify the asset contact password via a crafted direct request to the partial-save endpoint.
CVE(s)
CVE-2026-110287
Behebung und Workarounds
Upgrade to Devolutions Server 2026.3.10 or higher, 2026.2.20.0 or higher.
Server-side request forgery in PingOne groups endpoint
2.6 Low - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate the stored PingOne application secret via an attacker-controlled PingOne configuration in the request parameter.
CVE(s)
CVE-2026-110805
Behebung und Workarounds
Upgrade to Devolutions Server 2026.3.10 or higher, 2026.2.20.0 or higher.
Danksagungen
d3vilx000r