Devolutions Server CVE-2026-93330

Exploitation requires an authenticated Devolutions Server account that already holds PAM edit permissions (PR:L) and requires the PAM Active Directory provider to be in use with a Devolutions Gateway host ruleset configured to restrict host access - the flaw only matters where such a ruleset is meant to enforce boundaries. Limiting factors: no anonymous or low-privilege user can trigger it (privileged PAM-edit role needed), no active exploitation observed (SSVC exploitation: none), impact is partial and confidentiality-scoped, and the affected component is the PAM AD provider specifically in Devolutions Server builds prior to 2026.3.7.0 (e.g., 2026.3.5). Patched by upgrading to 2026.3.7.0.

This is a low-severity, authorization-scoping weakness, not a high-impact breach. All signals align on low real-world risk: the vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N = 4.3) requires an already-authenticated actor holding PAM edit permissions, so this is a privileged-insider / privilege-scoping issue rather than a remote pre-auth flaw. CISA's SSVC decision framework reinforces this - Exploitation: none, Automatable: no, Technical Impact: partial - meaning no observed exploitation and only partial technical impact even if triggered. There is no EPSS score, no KEV listing, and no public exploit code; per the input this is 'no public exploit identified at time of analysis.' The confidentiality-only impact (C:L, I:N, A:N) is consistent with the described effect: bypassing the Devolutions Gateway host ruleset lets a PAM editor reach hosts the ruleset was meant to gate, rather than achieving code execution or data destruction. One minor tension worth noting: a host-ruleset bypass is arguably as much an integrity/access-control failure as a confidentiality leak, so the vendor's C:L/I:N split is defensible but could reasonably carry an I:L component. Overall this is a genuine-but-low-priority hardening fix for organizations running the affected build, not an urgent externally-exploitable threat.

A user who has been granted PAM edit permissions within Devolutions Server crafts or modifies a PAM Active Directory provider configuration so that the incorrectly-ordered rule enforcement fails to apply the Devolutions Gateway host ruleset. This lets that user establish PAM connections to gateway-restricted hosts they were not intended to reach. No public exploit code exists and CISA SSVC reports no observed exploitation, so realistic risk is limited to trusted-but-overprivileged insiders or a compromised PAM-editor account.