What is the CVSS score of CVE-2026-10544?

CVE-2026-10544 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Devolutions Server CVE-2026-10544

EUVD-2026-35184 MEDIUM

OS Command Injection (CWE-78)

2026-06-08 DEVOLUTIONS

Hashicorp Command Injection Server

6.5

CVSS 3.1 · Vendor: DEVOLUTIONS

Severity by source

Vendor (DEVOLUTIONS) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Primary rating from Vendor (DEVOLUTIONS) · only source for this CVE.

CVSS VectorVendor: DEVOLUTIONS

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 21:23 vuln.today

CVSS changed

Jun 08, 2026 - 21:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 08, 2026 - 18:26 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Improper neutralization of special elements in the built-in PAM provider password rotation templates in Devolutions Server allows an authenticated user with write access to a vault to execute arbitrary commands on the systems managed by the affected PAM provider.

This issue affects :

Devolutions Server 2026.2.4.0
Devolutions Server 2026.1.20.0 and earlier

AnalysisAI

Command injection (CWE-78) in Devolutions Server's built-in PAM provider password rotation templates allows an attacker with vault write access to execute arbitrary OS commands on systems managed by the affected PAM provider. Affected versions include 2026.2.4.0 and all releases at or below 2026.1.20.0, reported directly by the vendor Devolutions. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis, but the high-value nature of a PAM platform managing privileged credentials on downstream systems means the practical blast radius substantially exceeds what the CVSS C:L/I:L scores suggest.

Technical ContextAI

CWE-78 (Improper Neutralization of Special Elements used in an OS Command) describes a failure to sanitize user-controlled input before it is passed to an OS command interpreter. In this case, the vulnerable surface is the built-in PAM (Privileged Access Management) provider's password rotation template engine within Devolutions Server - a centralized secrets and privileged access platform. Password rotation templates define how credentials are cycled on managed systems; if special characters or shell metacharacters embedded in template fields are not neutralized, an attacker can inject arbitrary commands that execute in the context of the process performing the rotation. The HashiCorp tag in the intelligence record suggests that HashiCorp Vault-integrated workflows or HashiCorp-style PAM provider configurations may be specifically implicated, though the vulnerability is described as affecting the built-in PAM provider templates. The CPE string cpe:2.3:a:devolutions:server:*:*:*:*:*:*:*:* covers all Devolutions Server versions under NVD tracking.

RemediationAI

Patch available per vendor advisory at https://devolutions.net/security/advisories/DEVO-2026-0015/ - the specific patched version number is not identified in the available intelligence and must be confirmed directly from the Devolutions advisory before upgrading. Organizations should consult the advisory to determine the minimum safe release and apply it promptly. As an interim compensating control, restrict vault write permissions to the minimum required set of users and service accounts, specifically limiting who can create or modify PAM provider password rotation templates. Disabling or removing unused built-in PAM provider integrations (particularly HashiCorp-linked configurations if not in use) reduces exposure until patching is complete. Monitor Devolutions Server audit logs for unexpected template modifications or password rotation events as a detection measure. Note that restricting vault write access may impact legitimate automated password rotation workflows and should be coordinated with PAM administrators.