Devolutions Server CVE-2026-12755

Exploitation requires an existing authenticated session on Devolutions Server with the UserGroupsView permission explicitly assigned to the attacker's account. The PAM module with Active Directory provider discovery must be configured in the deployment - environments using Devolutions Server solely for non-PAM use cases are not exposed. The attacker must control a host reachable from the Devolutions Server over TCP 445 or 139 to receive the coerced NTLM authentication, and must have network access to submit requests to the PAM AD discovery endpoint. Exploitation is not automatable at scale (SSVC: Automatable: no) due to the authenticated access prerequisite. No user interaction beyond the attacker's own crafted request is required (UI:N). The limiting factors - a specific named permission, an optional PAM-AD module, and attacker-controlled reachable infrastructure - meaningfully reduce realistic risk relative to the network-vector CVSS score.

The vendor-assigned CVSS 3.1 score of 2.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) reflects the high privilege prerequisite (UserGroupsView permission) and limited direct confidentiality impact (NTLMv2 hash, not plaintext). EPSS at 0.22% (12th percentile) and SSVC signals - Exploitation: none, Automatable: no, Technical Impact: partial - consistently support a low short-term exploitation risk assessment. However, the raw CVSS score understates realistic impact in environments where PAM provider service accounts hold broad Active Directory privileges: a cracked or relayed NTLMv2 hash could enable lateral movement far beyond what a C:L rating implies. This is a case where CVSS severity and real-world consequence diverge. SSVC correctly marks Technical Impact as only partial at point of exploitation, but defenders should weigh the privileged-account context of the exposed credentials. The vulnerability is not in CISA KEV and no POC has been identified, making this a patch-on-schedule rather than emergency-response priority for most organizations.

An authenticated Devolutions Server user with the UserGroupsView permission submits a crafted PAM AD discovery request, substituting the DomainName field with the IP address of an attacker-controlled host running an SMB listener such as Responder. The Devolutions Server initiates an outbound NTLM authentication handshake to that host, and the listener captures the NTLMv2 challenge-response containing the PAM provider service account credential hash, which the attacker can crack offline with Hashcat or relay to other internal services to achieve lateral movement.