What is the CVSS score of CVE-2026-11890?

CVE-2026-11890 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-11890?

Yes, a patch is available for CVE-2026-11890. Update the affected software to the latest version immediately.

Devolutions Server CVE-2026-11890

EUVD-2026-37200 MEDIUM

CERT C++ Secure Coding Section 14 - Concurrency (CON) (CWE-882)

2026-06-16 DEVOLUTIONS

GHSA-hg6j-v242-jg66

Information Disclosure Devolutions Server Devolutions

4.3

CVSS 3.1 · Vendor: DEVOLUTIONS

Severity by source

Vendor (DEVOLUTIONS) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-accessible read-only disclosure requiring low-privilege authentication; no integrity or availability impact, and scope is unchanged within the PAM server boundary.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (DEVOLUTIONS).

CVSS VectorVendor: DEVOLUTIONS

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 16:39 vuln.today

Patch available

Jun 16, 2026 - 21:02 EUVD

CVE Published

Jun 16, 2026 - 18:24 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Improper access control in PAM account discovery results in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to retrieve account discovery scan results.

AnalysisAI

Improper access control in Devolutions Server's PAM account discovery module allows any authenticated low-privilege user to retrieve privileged account discovery scan results they are not authorized to view. Two maintenance branches are affected - versions prior to 2026.2.5 and 2026.1.21 - with vendor-released patches available via Devolutions advisory DEVO-2026-0017. No public exploit exists and EPSS sits at 0.14% (4th percentile), but the sensitivity of PAM account inventories in enterprise environments elevates the real-world impact beyond what the CVSS Medium rating alone conveys.

Technical ContextAI

Devolutions Server is an enterprise Privileged Access Management (PAM) platform that includes an account discovery feature for scanning and cataloguing privileged, service, and administrative accounts across an organization's infrastructure. The root cause is classified as CWE-882, indicating insufficient authorization enforcement on the API or UI endpoint that exposes account discovery scan results - the application does not correctly gate access based on user role or permission level. The CPE string cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:* covers all platform variants of the server product across both affected version branches. PAM account discovery outputs are particularly sensitive because they enumerate domain accounts, service credentials, and privileged targets, which are precisely the assets attackers seek during post-authentication lateral movement planning.

RemediationAI

Upgrade Devolutions Server to version 2026.2.5 (on the 2026.2.x branch) or 2026.1.21 (on the 2026.1.x branch) per the vendor advisory at https://devolutions.net/security/advisories/DEVO-2026-0017/. If immediate patching is not feasible, restrict PAM account discovery access through Devolutions Server's built-in role and permission system, ensuring that only authorized PAM administrators or operators are granted rights to view discovery scan results - this reduces the exposure surface while the patch is scheduled. Additionally, audit current user role assignments to identify accounts with broader-than-intended access to discovery functionality. Note that role-based restriction is a compensating control only and does not fix the underlying authorization flaw; patching remains the definitive remediation.