EUVD-2026-39386
GHSA-6vpw-rmvh-qc2w
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
PR:H reflects the requirement for a specific named permission (UserGroupsView); C:L reflects NTLMv2 hash exposure rather than plaintext credential disclosure; no integrity or availability impact applies.
Primary rating from Vendor (DEVOLUTIONS).
CVSS VectorVendor: DEVOLUTIONS
Lifecycle Timeline
3DescriptionCVE.org
Improper input validation in the PAM AD discovery endpoints in Devolutions Server 2026.2.4.0 through 2026.2.7.0 allows an authenticated user with the UserGroupsView permission to coerce server-side authentication to an attacker-controlled host, exposing PAM provider credentials as a NTLMv2 challenge-response, via a crafted DomainName parameter.
AnalysisAI
NTLM credential coercion in Devolutions Server 2026.2.4.0 through 2026.2.6.x allows an authenticated user with the UserGroupsView permission to redirect PAM Active Directory discovery requests to an attacker-controlled host, capturing PAM provider service account credentials as NTLMv2 challenge-response hashes. The vulnerability exists within the PAM AD discovery endpoints and is triggered by supplying a crafted DomainName parameter that causes the server to initiate an outbound NTLM authentication handshake. No public exploit code exists and the vulnerability is not listed in CISA KEV; EPSS is 0.22% (12th percentile), indicating very low current exploitation probability.
Technical ContextAI
Devolutions Server is an enterprise Privileged Access Management platform that integrates with Active Directory for automated privileged account discovery. The affected PAM AD discovery endpoints accept a DomainName parameter used to initiate server-side AD connectivity. CWE-1284 (Improper Validation of Specified Quantity in Input) describes the root cause: the DomainName value is not adequately validated before the server uses it as a target for NTLM authentication, a technique often called NTLM credential coercion. When the server connects to the attacker-supplied host, it presents an NTLMv2 challenge-response encoding the PAM provider service account credentials - capturable by any SMB listener (e.g., Responder). The hash can then be cracked offline or relayed against other internal services, potentially escalating far beyond the initial disclosure scope. Affected CPE: cpe:2.3:a:devolutions:server for versions 2026.2.4.0 through before 2026.2.7.0.
RemediationAI
Upgrade Devolutions Server to version 2026.2.7.0 or later per the vendor advisory at https://devolutions.net/security/advisories/DEVO-2026-0020/. If immediate patching is not feasible, restrict the UserGroupsView permission to the smallest possible set of trusted administrator accounts, reducing the attacker population - this does not eliminate the vulnerability but significantly narrows exploitability. As a network-level compensating control, configure Windows Firewall rules on the Devolutions Server host to block outbound NTLM traffic (TCP 445, TCP 139) to hosts outside the list of authorized domain controllers, preventing coerced NTLM handshakes from reaching attacker-controlled infrastructure; be aware that overly broad rules may disrupt legitimate AD connectivity and should be tested in a non-production environment first. After patching, rotate PAM provider service account credentials as a precautionary measure in case coercion attempts went undetected.
Traccar Traccar Server version 4.0 and earlier contains a CWE-94: Improper Control of Generation of Code ('Code Injectio
Account takeover in self-hosted Bitwarden Server before 2026.6.0 lets a low-privileged organization member steal any oth
Provider service users in Bitwarden Server Cloud can hijack arbitrary organizations via unauthorized API endpoint access
NoMachine Server is affected by Integer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack compl
NoMachine Server is affected by Buffer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack comple
Authentication bypass in Bitwarden Server versions prior to 2026.4.1 allows authenticated users with SCIM management pri
JetAudio jetCast Server 2.0 contains a stack-based buffer overflow vulnerability in the Log Directory configuration fiel
A broken authentication vulnerability in 4D SAS 4D Server software v17, v18, v19 R7, and earlier allows attackers to sen
An information disclosure vulnerability in 4D SAS 4D Server Application v17, v18, v19 R7 and earlier allows attackers to
Privilege escalation in self-hosted Bitwarden Server before 2026.5.0 lets an authenticated organization member holding a
Audit log integrity across all Bitwarden Server organizations can be undermined by any authenticated user, who may injec
In the webmail component in IceWarp Server 11.3.1.5, there was an XSS vulnerability discovered in the "language" paramet
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today