PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-110806 Devolutions CVE debrief

CVE-2026-110806 was published on 2026-10-16T13:44:20.481Z and has not been modified since then. The NVD entry is currently null. This CVE describes an incorrect authorization vulnerability in Devolutions Server 2026.3.8.0 and earlier, allowing authenticated users with View permission to obtain add-on passwords. The vulnerability impacts Devolutions Server instances, particularly those with users having View permissions. Defenders managing these instances should assess exposure and prioritize updating to a fixed version. The CVE record and source item provide details on the vulnerability, but information on exploitation and impact is limited. Devolutions has provided an advisory (DE

Vendor
Devolutions
Product
Server
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-16
Original CVE updated
2026-10-16
Advisory published
2026-10-16
Advisory updated
2026-10-16

Who should care

Defenders managing Devolutions Server instances, especially those with users having View permissions, should assess exposure and prioritize updating to a fixed version.

Why it matters

CVE-2026-110806 allows authenticated users with View permission to obtain add-on passwords in Devolutions Server 2026.3.8.0 and earlier. Defenders should verify exposure, restrict access, and monitor for suspicious activity.

  • Verify exposure in Devolutions Server instances
  • Restrict access to sensitive add-on properties
  • Monitor for potential unauthorized access attempts

Technical summary

CVE-2026-110806 is an incorrect authorization vulnerability in Devolutions Server 2026.3.8.0 and earlier. Authenticated users with only View permission can obtain add-on passwords due to unredacted add-on properties returned in connection data. The vulnerability affects Devolutions Server instances with users having View permissions, allowing them to access sensitive add-on properties. Defenders should verify exposure in their Devolutions Server instances and update to a fixed version if available. The CVE record and source item provide details on the

Defensive priority

Defenders should prioritize verifying exposure in their Devolutions Server instances, especially those with users having View permissions, and update to a fixed version if available.

Recommended defensive actions

  • Verify Devolutions Server version and exposure
  • Restrict View permissions for sensitive operations
  • Monitor for suspicious activity related to add-on properties

Evidence notes

The CVE record and source item provide details on the vulnerability, but information on exploitation and impact is limited. Devolutions has provided an advisory (DEVO-2026-0036).

Sources and references

Verified primary and authoritative sources

  • CVE-2026-110806 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-110806

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-110806 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-110806

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • CVE-2026-110806

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/110xxx/CVE-2026-110806.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://devolutions.net/security/advisories/DEVO-2026-0036/

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.