CVE-2026-114487 Devolutions CVE debrief

Who should care

Devolutions Server administrators and users with PAM licenses should assess exposure and apply patches or mitigations as needed. Security teams should review the vulnerability and implement compensating controls for exposed systems. IT teams should verify and apply patches, restrict access, and monitor for suspicious activity related to PAM sub-provider creation.

Why it matters

CVE-2026-114487 is a missing authorization vulnerability in Devolutions Server that allows authenticated non-administrative users to create PAM sub-providers. Defenders should verify and apply patches, restrict access, and monitor for suspicious activity.

• Verify and apply patches to prevent unauthorized PAM sub-provider creation
• Restrict access to the PAM AD computer import endpoint to prevent exploitation
• Monitor for suspicious activity related to PAM sub-provider creation

Technical summary

The vulnerability allows an authenticated non-administrative user with a PAM license to create PAM sub-providers under existing AD providers via a crafted import request in Devolutions Server versions 2026.3.5.0 through 2026.3.10.0 and 2026.2.20.0 and earlier. This is a missing authorization vulnerability in the PAM AD computer import endpoint. The vulnerability has a high impact on the confidentiality, integrity, and availability of the Devolutions Server environment. Defenders should verify and apply patches to prevent unauthorized creation of PAM sub-providers.

Defensive priority

Devolutions Server administrators should verify and apply the patch to prevent unauthorized creation of PAM sub-providers.

Recommended defensive actions

• Verify and apply the patch for Devolutions Server
• Restrict access to the PAM AD computer import endpoint
• Monitor for suspicious activity related to PAM sub-provider creation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, affected versions, and a reference to the vendor's advisory. The vulnerability was reported by an external researcher and verified by the vendor. The vendor has released a patch to address this issue. Users should verify their deployments, apply the patch, and monitor for suspicious activity related to PAM sub-provider creation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.