EUVD-2026-102876
GHSA-jhmq-jch2-cv3p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with PAM checkout access
-
ExploitCraft checkout update with malicious JIT settings
-
ExecutionServer applies unvalidated client-supplied elevation
-
ImpactDelete AD groups or retain elevated privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V4 - API and Web Service Object attribute protection
|
| Exploitation Conditions | Exploitation requires (1) a valid authenticated account on Devolutions Server (PR:L), (2) that account holding PAM checkout access, and (3) the PAM just-in-time (JIT) elevation feature being configured with Active Directory group management. The server must accept client-supplied JIT elevation settings in a checkout update request without re-validating them. Limiting factors: this is not reachable by anonymous/unauthenticated users, is confined to deployments actually using PAM with AD-backed JIT elevation (not a default of every install), and the attacker must already be inside the trust boundary as a provisioned PAM user, which substantially narrows the realistic attacker population. |
| Impact | This is a lower-tier, authenticated privilege/integrity issue rather than a widespread emergency. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3) shows a network-reachable, low-complexity flaw but explicitly requires existing privileges (PR:L) - specifically a user who already holds PAM checkout access - and yields only partial integrity impact. All exploitation-pressure signals agree and point LOW: SSVC reports Exploitation=none, Automatable=no, Technical Impact=partial; there is no CISA KEV listing and no public exploit identified at time of analysis; no EPSS score was supplied in the input. The signals are mutually consistent - nothing here conflicts - so this reads as a real but bounded insider/abuse-of-access risk, not a mass-exploitation priority. One caveat to verify: the real-world impact (deleting arbitrary Active Directory groups) is more consequential than the vendor's C:N/I:L/A:N scoring implies, because it can cross from the Devolutions Server into the Active Directory authority - the base score likely understates blast radius even though exploitation probability is genuinely low. |
| Exploit ScenarioDerived | A low-privileged but legitimate Devolutions Server user who has been granted PAM checkout access submits a checkout update request containing attacker-chosen JIT elevation settings. Because the server trusts these client-supplied values, the user can delete arbitrary Active Directory groups or keep elevated privileges past the intended just-in-time window. No public exploit code is known, and the attack requires a valid account with PAM checkout access, so this is an authenticated abuse-of-trust scenario rather than remote drive-by. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 16, 2026
Authenticated PAM checkout users on Devolutions Server 2026.3.8.0 and earlier can manipulate the just-in-time (JIT) elevation settings embedded in a checkout update request to delete arbitrary Active Directory groups or preserve elevated privileges that should have been dropped at checkout. The flaw is a server-side trust issue: the application accepts client-supplied JIT elevation parameters without re-validating them, so an attacker only needs a provisioned account that already holds PAM checkout access. There is no public exploit identified at time of analysis, exploitation is not listed in CISA KEV, and the vendor has released a patched version; CVSS scores are modest (4.3 vendor base; independent assessment 4.3 with Scope:Changed, reflecting limited integrity and availability impact rather than confidentiality loss).
RemediationAI
Upgrade to Devolutions Server 2026.3.10 or later, which is the vendor-released patched version per EUVD (Server 0 < 2026.3.10) and the referenced advisory https://devolutions.net/security/advisories/DEVO-2026-0036/; the vendor confirms a patch is available, so remediation is straightforward and should be prioritized for any deployment using PAM checkout with Active Directory-backed JIT elevation. If immediate upgrade is not possible, compensating controls should focus on the three conditions the independent assessment identifies as prerequisites: remove or reduce PAM checkout access for users who do not strictly need it (this narrows the attacker population to provisioned PAM users and is the single most effective stopgap), and audit or temporarily disable the just-in-time elevation feature where it manages Active Directory groups - the trade-off being loss of automated JIT privilege brokering, requiring manual or alternative elevation processes. Restricting network reachability of the Devolutions Server web console to trusted administrative networks reduces exposure but does not fix the underlying lack of server-side validation, and monitoring PAM checkout audit logs for unexpected AD group deletions or checkouts that fail to terminate elevation can provide early detection with minimal operational cost. Note that the vendor's advisory should be consulted for any product-specific mitigation guidance before disabling PAM functionality.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause maps to CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes), the class of bug often described as mass assignment - the server binds attacker-controlled fields from a checkout update request directly onto an internal PAM elevation object instead of whitelisting the fields a client is permitted to set. Devolutions Server's PAM (Privileged Access Management) module performs just-in-time elevation, brokering temporary privileged access to managed systems and, in this case, to Active Directory group membership. When a checkout is updated, the client can supply JIT elevation settings that the server should treat as read-only, but instead applies verbatim. This lets an authenticated PAM user either direct the checkout logic to remove arbitrary AD groups or keep an elevation that the checkout should have terminated. Because the impact is scoped to deployments that have PAM enabled with AD-backed JIT elevation configured, affected installations are those running Devolutions Server up to and including 2026.3.8.0; the CPE cpe:2.3:a:devolutions:server:*:*:*:*:*:*:*:* reflects the wildcard coverage of all Server editions in that range, and ENISA EUVD records the vulnerable range as Server 0 < 2026.3.10.
Know when Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Requires an authenticated PAM-checkout user (PR:L); impact crosses into Active Directory (S:C) with integrity loss plus destructive group deletion (A:L); no confidentiality impact (C:N).
Primary rating from Vendor (DEVOLUTIONS).
CVSS VectorVendor: DEVOLUTIONS
Lifecycle Timeline
4DescriptionCVE.org
Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with PAM checkout access to delete arbitrary Active Directory groups or retain elevated privileges via client-supplied JIT elevation settings in a checkout update request.
Threat Intelligence Overview
NVD
CVE.org
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Traccar Traccar Server version 4.0 and earlier contains a CWE-94: Improper Control of Generation of Code ('Code Injectio
Account takeover in self-hosted Bitwarden Server before 2026.6.0 lets a low-privileged organization member steal any oth
Full user impersonation in the Laci Synchroni sync server (backend prior to 1.2.3) lets an attacker take over any accoun
Provider service users in Bitwarden Server Cloud can hijack arbitrary organizations via unauthorized API endpoint access
NoMachine Server is affected by Integer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack compl
NoMachine Server is affected by Buffer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack comple
Authentication bypass in Bitwarden Server versions prior to 2026.4.1 allows authenticated users with SCIM management pri
JetAudio jetCast Server 2.0 contains a stack-based buffer overflow vulnerability in the Log Directory configuration fiel
Credential-holding attackers can completely bypass TOTP two-factor authentication on Sync-in Server versions prior to 2.
A broken authentication vulnerability in 4D SAS 4D Server software v17, v18, v19 R7, and earlier allows attackers to sen
An information disclosure vulnerability in 4D SAS 4D Server Application v17, v18, v19 R7 and earlier allows attackers to
Privilege escalation in self-hosted Bitwarden Server before 2026.5.0 lets an authenticated organization member holding a
Exploit-DB