What is the CVSS score of CVE-2026-4924?

CVE-2026-4924 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Server CVE-2026-4924

EUVD-2026-17923 HIGH

Weak Authentication (CWE-1390)

2026-04-01 DEVOLUTIONS

Authentication Bypass Server Devolutions

8.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.2 HIGH

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 01, 2026 - 15:30 euvd

EUVD-2026-17923

Analysis Generated

Apr 01, 2026 - 15:30 vuln.today

CVE Published

Apr 01, 2026 - 14:50 nvd

HIGH 8.2

DescriptionCVE.org

Improper authentication in the two-factor authentication (2FA) feature in Devolutions Server 2026.1.11 and earlier allows a remote attacker with valid credentials to bypass multifactor authentication and gain unauthorized access to the victim account via reuse of a partially authenticated session token.

AnalysisAI

Devolutions Server 2026.1.11 and earlier allows authenticated remote attackers to bypass two-factor authentication by reusing a partially authenticated session token, enabling unauthorized account access without completing the second authentication factor. The vulnerability affects all versions up to and including 2026.1.11, with no CVSS score or public exploit confirmation available at analysis time.

Technical ContextAI

The vulnerability resides in the two-factor authentication (2FA) implementation within Devolutions Server, a privileged access management platform. The root cause is classified under CWE-1390 (Improper Handling of Insufficient Data Validation), which encompasses failures in the authentication state machine where partially authenticated session tokens are not properly invalidated or re-verified after the first authentication factor succeeds. This allows an authenticated attacker to reuse an intermediate session token that has passed the first factor (username/password) but not yet completed the second factor (OTP, security key, etc.), effectively skipping or bypassing the MFA enforcement. The flaw impacts the entire Devolutions Server product line as indicated by the CPE wildcard (cpe:2.3:a:devolutions:server:*:*:*:*:*:*:*:*), suggesting all versions are affected until the stated cutoff of 2026.1.11.

RemediationAI

Organizations should immediately upgrade Devolutions Server to the patched version released by Devolutions after 2026.1.11; consult the security advisory at https://devolutions.net/security/advisories/DEVO-2026-0010 for the exact fixed version number. Until patching is possible, consider enforcing network-level controls to restrict access to Devolutions Server to trusted networks only, disabling 2FA bypass attack vectors by enforcing strict session invalidation policies, and conducting an audit of recent authentication logs to detect any suspicious session reuse or MFA bypass attempts. Monitor for any indicators of unauthorized account access or privilege escalation following potential exploitation.