CVE-2026-114486 Devolutions CVE debrief

Who should care

Defenders responsible for Devolutions Server deployments should assess exposure and prioritize verification and remediation efforts. This includes operators, platform administrators, vulnerability management teams, and security teams who need to review and implement compensating controls.

Why it matters

CVE-2026-114486 is an incorrect authorization vulnerability in Devolutions Server that allows authenticated attackers to bypass Network Access Rules. Defenders should assess exposure, prioritize verification and remediation efforts, and implement compensating controls.

• Authenticated attackers may bypass Network Access Rules
• Defenders must verify and upgrade to a fixed version
• Exposure requires assessment and compensating controls

Technical summary

The vulnerability is caused by incorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3.10.0 and earlier. An authenticated non-administrative attacker can exploit this to bypass Network Access Rules of a virtual gateway and reach denied hosts via wildcard additional destinations signed into the gateway token. The vulnerability impacts Devolutions Server deployments, and defenders should assess exposure and prioritize verification and remediation efforts. The CVE record and source item provide details on the vulnerability, affected versions, and references to vendor advisories.

Defensive priority

Defenders should prioritize verifying and upgrading to a fixed version of Devolutions Server, assessing exposure, and implementing compensating controls.

Recommended defensive actions

• Verify and upgrade to a fixed version of Devolutions Server
• Assess exposure and implement compensating controls
• Monitor for suspicious activity related to gateway token generation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, affected versions, and references to vendor advisories. The vulnerability is confirmed in Devolutions Server 2026.3.10.0 and earlier. Defenders should verify and upgrade to a fixed version, assess exposure, and implement compensating controls. The source item provides CVE details and affected versions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.