Devolutions Server CVE-2026-8407

Exploitation requires: (1) valid Devolutions Server authentication credentials for an account holding a PAM license, (2) network access to the Devolutions Server PAM API endpoints, (3) the PAM module to be enabled and operational in the target instance, and (4) the attacker must know or enumerate OTP secret identifiers or recovery code references to request them. The vulnerability is NOT exploitable against default configurations where the PAM module is disabled, nor against users without a PAM license. Authentication is mandatory (CVSS PR:L), but no elevated role or special permission beyond holding a PAM license is required, making this exploitable by low-privilege, license-holding users within an organization.

This vulnerability presents a moderate but nuanced risk profile. The CVSS score of 4.3 (Low severity) aligns with a confidentiality-only impact (CWE-862 authorization bypass), yet is somewhat elevated by the network attack vector and low complexity. The EPSS score of 0.01% (2nd percentile) strongly indicates this is NOT a widespread exploitation target and has minimal likelihood of automated exploitation in the wild. The attack requires network access but only to authenticated users with an existing PAM license, significantly narrowing the threat surface. Attack complexity is low, but privileges required (PR:L) and lack of scope change (S:U) further constrain impact. The practical risk depends heavily on: (1) how many users within an organization hold PAM licenses, (2) the business sensitivity of OTP secrets and recovery codes in the target environment, and (3) whether lateral privilege escalation via compromised OTP credentials is feasible. For most organizations, this is a medium-priority patch due to the low EPSS but should be prioritized if OTP codes provide meaningful escalation paths.

An authenticated user with a PAM license but no elevated permissions crafts HTTP requests directly to Devolutions Server's PAM API endpoints, requesting OTP secret keys or recovery codes for other user accounts. The insufficient authorization check allows the request to succeed, returning sensitive OTP data. The attacker then uses these secrets to bypass multi-factor authentication on target user accounts, gaining account access without additional privileges or user interaction.