What is the CVSS score of CVE-2026-14536?

CVE-2026-14536 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Devolutions Server are affected by CVE-2026-14536?

Devolutions Server (DVLS) versions 2026.2.4 through 2026.2.8 allow authenticated users to bypass mandatory multi-factor authentication.. A patch is available.

How to fix or mitigate CVE-2026-14536?

Within 24 hours: Inventory all systems running DVLS and confirm version numbers, prioritizing identification of systems in versions 2026.2.4 through 2026.2.8. Within 7 days: Obtain the vendor-released patch from Devolutions and deploy to all affected systems, testing in staging first. Within 30 days: Verify patch deployment across all DVLS instances and audit authentication logs for evidence of MFA bypass exploitation during the exposure window.

Devolutions Server CVE-2026-14536

EUVD-2026-41905 HIGH

Incorrect Authorization (CWE-863)

2026-07-06 DEVOLUTIONS

GHSA-w6f7-pj3m-833j

Authentication Bypass Server

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable login with low-complexity trigger; PR:L because valid credentials are required, and full authenticated account access yields high C/I/A.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 12:23 vuln.today

CVSS changed

Jul 08, 2026 - 12:22 NVD

8.8 (HIGH)

Patch available

Jul 06, 2026 - 21:16 EUVD

CVE Published

Jul 06, 2026 - 19:23 cve.org

UNKNOWN (no severity yet)

DescriptionNVD

Improper enforcement of a mandatory multi-factor authentication policy in Devolutions Server 2026.2.9.0 allows an attacker with valid user credentials to bypass the MFA Required policy and authenticate without completing multi-factor authentication. The problem occurs when DVLS encounters an invalid default MFA value.

AnalysisAI

Multi-factor authentication bypass in Devolutions Server (DVLS) versions 2026.2.4 through 2026.2.8 lets an attacker who already holds valid user credentials authenticate without completing MFA, defeating an enforced 'MFA Required' policy. The flaw triggers when DVLS encounters an invalid default MFA value, causing the mandatory second factor to be skipped. It is vendor-reported with a patch available; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.18%, 8th percentile).

Technical ContextAI

Devolutions Server is a self-hosted privileged-access and credential/secret management platform used to broker access to remote sessions, passwords, and infrastructure secrets, so its authentication layer is a high-value control point. The root cause is classed as CWE-863 (Incorrect Authorization): the policy engine that is supposed to require a second authentication factor makes a flawed authorization decision when the stored/default MFA value is invalid, and instead of failing closed it fails open and grants a fully authenticated session. The single affected CPE is cpe:2.3:a:devolutions:server, indicating this is a server-side logic defect in the DVLS application rather than a client or protocol issue.

RemediationAI

Vendor-released patch: upgrade Devolutions Server to 2026.2.9.0 (the first release outside the affected 2026.2.4-2026.2.8 range), following vendor advisory DEVO-2026-0023 at https://devolutions.net/security/advisories/DEVO-2026-0023/. Because exploitation requires valid credentials, until patching is complete reduce risk by tightening credential hygiene and rotating passwords for accounts governed by the MFA Required policy, auditing recent authentication logs for logins that completed without an MFA challenge, and validating that MFA default values are correctly configured for every user (an invalid default is the trigger condition). Consider temporarily restricting network access to the DVLS authentication endpoints to trusted management networks or VPN as a compensating control; the trade-off is reduced accessibility for legitimate remote users, so scope it to the exposure window before the upgrade.