CVE-2026-110287 Devolutions CVE debrief

Who should care

Defenders and administrators of Devolutions Server should assess exposure and verify access controls. They should prioritize verifying and restricting access to the partial-save endpoint, ensuring that users only have necessary permissions. This includes reviewing compensating controls for exposed systems, checking relevant monitoring, detection, and logs for exposed assets, and tracking exceptions and retesting remediated assets.

Why it matters

CVE-2026-110287 is an improper access control vulnerability in Devolutions Server that allows authenticated users to modify asset contact passwords. Defenders should verify and restrict access to the partial-save endpoint, ensuring users only have necessary permissions. The impact of this vulnerability requires verification from official sources, and evidence is limited to CVE and source item details.

• Verification of access controls for the partial-save endpoint is required.
• Restricting access to the partial-save endpoint to prevent unauthorized modifications is necessary.
• Monitoring for suspicious activity on the partial-save endpoint is recommended.

Technical summary

CVE-2026-110287 is an improper access control vulnerability in Devolutions Server 2026.3.8.0 and earlier. An authenticated user with general Edit but without Edit asset permission can modify the asset contact password via a crafted direct request to the partial-save endpoint. This vulnerability allows authenticated users to modify asset contact passwords. Defenders should verify and restrict access to the partial-save endpoint, ensuring that users only have necessary permissions. The impact of this vulnerability requires verification from official sources.

Defensive priority

Defenders should prioritize verifying and restricting access to the partial-save endpoint, ensuring that users only have necessary permissions.

Recommended defensive actions

• Verify and restrict access to the partial-save endpoint
• Ensure users only have necessary permissions
• Monitor for suspicious activity on the partial-save endpoint
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability. The Devolutions advisory (DEVO-2026-0036) may offer additional information. Evidence is limited to CVE and source item details. Defenders should verify and restrict access to the partial-save endpoint, ensuring users only have necessary permissions. Limited evidence suggests that an authenticated user with general Edit but without Edit asset permission can modify the asset contact password via a crafted direct request to the partial-save endpoint.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.