Live › vulnerability › CVE-2026-114486
Go to dashboardDevolutions Server 2026.3.10.0 and earlier has an authorization flaw in how Devolutions Gateway generates tokens. An authenticated non-administrative user can use wildcard additional destinations to bypass the gateway's Network Access Rules and reach hosts that should be denied.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Devolutions Server 2026.3.10.0 or earlier with virtual gateways that enforce Network Access Rules. Exposure depends on authenticated non-administrative users being able to request tokens with wildcard additional destinations. Installations on a later version can skip it.
No product ranges from the sources yet.
2026.3.10.02026.3.10.0; the sources do not name the exact fixed releaseEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3.10.0 and earlier allows an authenticated non-administrative attacker to bypass the Network Access Rules of a virtual gateway and reach denied hosts via wildcard additional destinations signed into the gateway token.
This page as .md · .json · in your agent: get_signal("CVE-2026-114486")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.