CVE-2026-12755 Devolutions CVE debrief

Who should care

Administrators and security teams responsible for Devolutions Server installations should be aware of this vulnerability. Specifically, those with UserGroupsView permissions are at risk of being exploited. Additionally, security professionals monitoring for potential credential exposure and lateral movement within PAM environments should prioritize this issue.

Technical summary

The vulnerability exists in the PAM AD discovery endpoints of Devolutions Server. An authenticated user with UserGroupsView permission can manipulate the DomainName parameter to coerce server-side authentication to an attacker-controlled host. This results in the exposure of PAM provider credentials through an NTLMv2 challenge-response. The issue is due to improper input validation and has been assigned a CVSS score of 2.7, indicating low severity.

Defensive priority

Given the low severity and specific conditions required for exploitation, this vulnerability is not a high-priority issue. However, it should be addressed in the context of regular security updates and patch management for Devolutions Server.

Recommended defensive actions

• Apply the vendor-provided patch (DEVO-2026-0020) to update Devolutions Server to a version beyond 2026.2.7.0.
• Restrict UserGroupsView permissions to only necessary personnel.
• Monitor authentication logs for unusual activity related to PAM AD discovery endpoints.
• Implement additional monitoring for potential credential exposure and lateral movement within PAM environments.
• Review and update incident response plans to include potential credential coercion scenarios.

Evidence notes

The CVE record and NVD detail provide official information about the vulnerability. The vendor advisory (DEVO-2026-0020) offers mitigation and patch information. The vulnerability's low severity and specific exploitation conditions suggest that immediate action may not be critical, but it should be addressed in the context of regular security updates.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.