CVE-2026-9047 Devolutions CVE debrief

Who should care

Administrators and users of Devolutions Server 2026.1.6.0 through 2026.1.16.0 should be aware of this vulnerability and take necessary actions to mitigate it. This includes reviewing and reconfiguring multi-factor authentication settings, monitoring for suspicious activity, and applying the patch or update to a version outside the affected range. Additionally, operators and security teams should prioritize patching or mitigating this vulnerability, as it allows for bypassing multi-factor authentication. Consider implementing additional security measures such as reviewing compensating controls for exposed systems while remediation is scheduled and verified.

Technical summary

The vulnerability affects Devolutions Server 2026.1.6.0 through 2026.1.16.0. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L. The weakness is classified as CWE-305. The vulnerability is caused by improper handling of factor key state in the multi-factor authentication management feature, allowing an attacker with knowledge of a user's password to bypass the user's multi-factor authentication after the user reconfigures their factors. This issue can be mitigated by applying the patch or update to a version outside the affected range, reviewing and reconfiguring multi-factor authentication settings, and monitoring for suspicious activity.

Defensive priority

High priority should be given to patching or mitigating this vulnerability, as it allows for bypassing multi-factor authentication. Consider implementing additional security measures such as reviewing and reconfiguring multi-factor authentication settings, monitoring for suspicious activity, and applying the patch or update to a version outside the affected range. Also, review compensating controls for exposed systems while remediation is scheduled and verified, and check relevant monitoring, detection, and logs for exposed assets that need extra review. Track exceptions, retest remediated assets, and close the item only after evidence is documented. Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Asset inventory and source tracking are also recommended to ensure thorough mitigation and verification of the vulnerability's impact on the environment. Rollback and change windows should be considered if immediate patching is not feasible. This approach ensures a comprehensive defensive strategy against the vulnerability. The goal is to enhance security posture by addressing potential weaknesses and ensuring that all necessary steps are taken to protect against exploitation. By prioritizing defensive measures and taking a proactive approach, organizations can minimize the risk associated with CVE-2026-9047 and maintain the integrity of their systems and data. It is crucial to stay informed about the latest developments regarding this vulnerability and to adjust defensive strategies accordingly. Continuous monitoring and adaptation are key to effective vulnerability management and mitigation. Therefore, it is essential to stay vigilant and proactive in addressing CVE-2026-9047 to safeguard against potential threats and ensure the security and resilience of critical systems and infrastructure. The implementation of these defensive measures will significantly enhance the overall security posture of

Recommended defensive actions

• Apply the patch or update to a version outside the affected range
• Review and reconfigure multi-factor authentication settings
• Monitor for suspicious activity
• Consider implementing additional security measures
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-05-22T16:16:23.533Z and was last modified on 2026-07-23T16:10:00.137Z. The NVD entry is currently Analyzed. The vulnerability affects Devolutions Server 2026.1.6.0 through 2026.1.16.0. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L. The weakness is classified as CWE-305. Administrators and users of Devolutions Server 2026.1.6.0 through 2026.1.16.0 should be aware of this vulnerability and take necessary actions to mitigate it.

Official resources