Live › vulnerability › CVE-2026-110804
Go to dashboardDevolutions Server accepts client-supplied just-in-time elevation settings in PAM checkout update requests, so an authenticated user with PAM checkout access can alter them. The flaw lets that user delete arbitrary Active Directory groups or keep elevated privileges after checkout.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Deployments of Devolutions Server that use PAM checkout with just-in-time elevation and give users PAM checkout access are exposed. The sources do not say which other configurations are required, so the unknown parts are not assumed. Teams not running Devolutions Server, or running a fixed version, can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| devolutions server | vendor | < 2026.2.20.0 | 2026.2.20.0 |
| devolutions server | vendor | >= 2026.3.5.0, < 2026.3.10.0 | 2026.3.10.0 |
2026.2.20.0 and >= 2026.3.5.0, < 2026.3.10.0, per the sources' affected versions.2026.3.10.0 if on the 2026.3.5.0 to 2026.3.9.x line.2026.2.20.0 if on an earlier release.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with PAM checkout access to delete arbitrary Active Directory groups or retain elevated privileges via client-supplied JIT elevation settings in a checkout update request.
This page as .md · .json · in your agent: get_signal("CVE-2026-110804")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.