Server CVE-2026-4927

While CVSS and EPSS scores are unavailable, the real-world risk is elevated for organizations using Devolutions Server in multi-user environments. The attack vector is network-based and requires authentication plus role-based access (PR:L or PR:H qualifiers likely apply), reducing opportunistic attack likelihood but increasing insider threat risk. The vulnerability directly undermines MFA security-a critical control-meaning successful exploitation can lead to unauthorized account access and credential theft. The narrow version range (2026.1.6 through 2026.1.11) and clear vendor advisory suggest rapid patching occurred; however, organizations running these specific versions or with accounts possessing user management privileges face moderate-to-high risk depending on their threat model. No public exploit code or active CISA KEV confirmation is noted in the input, but the sensitivity of OTP key exposure warrants immediate patching regardless of exploitation signals.

A system administrator with legitimate user management privileges but compromised credentials is leveraged by an attacker to query the Devolutions Server API and extract OTP keys for high-privilege accounts. Using the retrieved seeds, the attacker generates valid one-time codes offline, bypassing MFA and gaining persistent access to the accounts. Alternatively, a malicious insider with user management access harvests OTP keys to enable unauthorized access to other users' resources without detection, as MFA validation can be satisfied without the account owner's knowledge.