CVE-2026-110804 Devolutions CVE debrief

Who should care

Authenticated users with PAM checkout access in Devolutions Server 2026.3.8.0 and earlier should verify and limit JIT elevation settings to prevent unauthorized Active Directory group deletion or privilege escalation.

Why it matters

CVE-2026-110804 allows an authenticated user with PAM checkout access to delete arbitrary Active Directory groups or retain elevated privileges in Devolutions Server 2026.3.8.0 and earlier. Authenticated users with PAM checkout access should verify and limit JIT elevation settings to prevent unauthorized Active Directory group deletion or privilege escalation.

• Potential deletion of arbitrary Active Directory groups.
• Potential retention of elevated privileges.
• Verification of JIT elevation settings is required to prevent exploitation.
• Monitoring and auditing of Active Directory group changes are necessary to detect potential malicious activity.

Technical summary

The vulnerability exists in Devolutions Server 2026.3.8.0 and earlier, allowing an authenticated user with PAM checkout access to delete arbitrary Active Directory groups or retain elevated privileges via client-supplied JIT elevation settings in a checkout update request. This could lead to potential deletion of arbitrary Active Directory groups or retention of elevated privileges. Authenticated users with PAM checkout access should verify and limit JIT elevation settings to prevent unauthorized Active Directory group deletion or privilege escalation.

Defensive priority

Authenticated users with PAM checkout access should verify and limit JIT elevation settings to prevent unauthorized Active Directory group deletion or privilege escalation.

Recommended defensive actions

• Verify and limit JIT elevation settings in Devolutions Server to prevent unauthorized Active Directory group deletion or privilege escalation.
• Restrict PAM checkout access to minimize the impact of potential exploitation.
• Monitor and audit Active Directory group changes to detect potential malicious activity.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE description provides details on the vulnerability, including the affected versions of Devolutions Server and the potential impact of an authenticated user with PAM checkout access. The vulnerability exists in Devolutions Server 2026.3.8.0 and earlier, allowing an authenticated user with PAM checkout access to delete arbitrary Active Directory groups or retain elevated privileges via client-supplied JIT elevation settings in a checkout update request. Evidence is limited to CVE description and source-provided metadata.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.