Security & compliance
Upholding the highest standards to protect your data and ensure trust.
DEVO-2026-0015
Devolutions Server is affected by multiple vulnerabilities.
Affected Products
Change Log
Initial publication - 2026-06-03
7.1 High - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N
Improper access control exposes cleartext ticketing integration credentials
Improper access control in the ticketing integration settings in Devolutions Server allows an authenticated low-privileged user to obtain cleartext credentials for configured ticketing integrations via a crafted API request.
Affected Products
CVE(s)
CVE-2026-10786
Remediation and Workarounds
Upgrade to Devolutions Server 2026.2.5.0 or higher, 2026.1.21.0 or higher.
6.5 Medium - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:H/SI:H/SA:H
Injection in built-in PAM provider password rotation templates
Improper neutralization of special elements in the built-in PAM provider password rotation templates in Devolutions Server allows an authenticated user with write access to a vault to execute arbitrary commands on the systems managed by the affected PAM provider.
Affected Products
CVE(s)
CVE-2026-10544
Remediation and Workarounds
Upgrade to Devolutions Server 2026.2.5.0 or higher, 2026.1.21.0 or higher.
5.3 Medium - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Missing authorization on deleted user groups endpoint
Missing authorization in the deleted user groups API in Devolutions Server allows an authenticated low-privileged user to enumerate metadata of deleted user groups via a crafted API request.
Affected Products
CVE(s)
CVE-2026-10787
Remediation and Workarounds
Upgrade to Devolutions Server 2026.2.5.0 or higher, 2026.1.21.0 or higher.