Devolutions Server CVE-2026-14536

Exploitation requires the attacker to already hold valid DVLS user credentials (CVSS PR:L confirms authenticated access is needed), and the specific trigger is that DVLS encounters an invalid default MFA value for the account, at which point the mandatory MFA step is skipped. It applies only to DVLS instances running versions 2026.2.4 through 2026.2.8 that have the 'MFA Required' policy enforced. Limiting factors: the bypass does not grant credentials by itself (it defeats only the second factor, so a stolen or valid password is a prerequisite), it depends on the invalid-default MFA condition rather than affecting any account universally, and patched versions (2026.2.9.0+) are not exploitable - no user interaction is required beyond the attacker's own login.

The CVSS 3.1 base score is 8.8 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, meaning network-reachable, low-complexity, and requiring only low-privilege valid credentials with no user interaction. Signals conflict on urgency: EPSS is low (0.18%, 8th percentile) and the vulnerability is NOT in CISA KEV, with no POC identified, so there is no evidence of active or widespread exploitation. The practical severity hinges on a real precondition the CVSS PR:L captures - the attacker must already possess valid credentials - so this is best understood as a defense-in-depth failure that neutralizes MFA rather than a wormable pre-auth breach. Because DVLS is a privileged-access product, an MFA bypass materially raises the impact of any stolen or phished credential, making it a meaningful priority for organizations that rely on the MFA Required policy as a compensating control. Note the C:H/I:H/A:H impact reflects the access a compromised account would inherit, not memory-corruption code execution - verify the privilege level of at-risk accounts against DVLS role assignments.

An attacker who has phished or otherwise obtained a legitimate low-privilege DVLS user's password targets an account whose MFA default value is invalid; when they log in, DVLS mishandles that invalid default and issues a fully authenticated session without ever prompting for the second factor. The organization believed its MFA Required policy protected the account, but the attacker reaches privileged secrets and sessions with only the stolen password. No public POC is identified, and the attack requires prior credential compromise plus the specific invalid-default condition.