Devolutions Server CVE-2026-11890

Exploitation requires a valid authenticated session on Devolutions Server with at least low-privilege access (PR:L per CVSS vector). The PAM account discovery module must be actively used - meaning discovery scans must have been executed and results stored - for any data to be retrievable. Unauthenticated attackers cannot exploit this flaw. Limiting factors include: (1) attacker must possess valid Devolutions Server credentials at any privilege level, (2) the target deployment must have run PAM account discovery scans, and (3) the instance must be running a version prior to 2026.2.5 or 2026.1.21. SSVC's automatable: no assessment indicates the flaw cannot be reliably exploited at scale without a valid account, which further constrains the attacker pool to insiders or already-compromised credential holders.

The vendor-supplied CVSS 4.3 (Medium) vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N is consistent with the described flaw: it is remotely exploitable over a network, requires no complex preconditions, but does require a valid low-privilege account. EPSS at 0.14% (4th percentile) is very low, and SSVC independently confirms exploitation status as none with automatable assessed as no - meaning mass exploitation is not expected or feasible. SSVC's partial technical impact rating correctly bounds the risk: the exposure is read-only access to discovery scan metadata, not credential material itself. However, the nature of the exposed data matters: account discovery results in a PAM environment reveal privileged account names, target system scope, and naming conventions, all of which are useful for reconnaissance in a compromised environment. This makes the real-world risk modestly higher than a generic C:L information disclosure in a non-PAM context. There are no conflicting signals - CVSS, EPSS, and SSVC are mutually consistent. This is a real finding warranting a routine patch cycle, not emergency response.

An authenticated help desk operator or read-only auditor account sends a direct API request to the PAM account discovery results endpoint, bypassing the expected permission boundary. The server returns scan results enumerating privileged accounts, service accounts, and target systems across the organization, giving the attacker a detailed map of high-value assets for subsequent lateral movement. No public exploit code exists at time of analysis; the attack requires valid credentials to Devolutions Server and a prior account discovery scan having been executed.