CVE-2026-114485 Devolutions CVE debrief

Who should care

Defenders responsible for Devolutions Server instances, particularly those with authenticated users and MFA enabled, should assess exposure and prioritize remediation to prevent potential MFA secret disclosure.

Why it matters

CVE-2026-114485 allows authenticated attackers with delegated user view permissions to obtain MFA secrets of all users in Devolutions Server 2026.3.10.0 and earlier. Defenders should verify exposure, prioritize remediation, and monitor for potential misuse.

• Verification of Devolutions Server exposure to authenticated attackers with delegated user view permissions is required.
• Remediation priority is high due to potential disclosure of MFA secrets.
• Monitoring of user list API responses is necessary to detect potential misuse.

Technical summary

In Devolutions Server 2026.3.10.0 and earlier, an authenticated attacker with delegated user view permissions can obtain the MFA secrets of all users via the user list API response due to insufficient protection of sensitive information in the user list endpoint. The affected product is Devolutions Server, version 2026.3.10.0 and earlier. Defenders should verify exposure, prioritize remediation, and monitor for potential misuse. The vulnerability allows for potential disclosure of MFA secrets, emphasizing the need for prompt action.

Defensive priority

Authenticated attackers with delegated user view permissions can obtain MFA secrets of all users via the user list API response in Devolutions Server 2026.3.10.0 and earlier. Defenders should verify exposure, prioritize remediation, and monitor for potential misuse.

Recommended defensive actions

• Verify if Devolutions Server instances are exposed to authenticated attackers with delegated user view permissions.
• Prioritize remediation of affected Devolutions Server instances to prevent potential MFA secret disclosure.
• Monitor user list API responses for potential misuse or unauthorized access.
• Update Devolutions Server to version 2026.3.11 or later.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE description states that insufficient protection of sensitive information in the user list endpoint allows an authenticated attacker to obtain MFA secrets of all users. The affected product is Devolutions Server, version 2026.3.10.0 and earlier.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.