Live › vulnerability › CVE-2026-114487
Go to dashboardDevolutions Server's PAM AD computer import endpoint does not check authorization, so a logged-in non-admin user with a PAM license can create PAM sub-providers under existing AD providers with a crafted request. The sources do not describe data exposure or code execution beyond that.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Devolutions Server in the listed version ranges with PAM licensing and AD provider integration, where non-admin users have accounts. Installations without PAM or without AD providers are unlikely to be exposed, but the sources do not say this explicitly.
No product ranges from the sources yet.
2026.3.5.0 through 2026.3.10.0, and 2026.2.20.0 and earlier.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing authorization in the PAM AD computer import endpoint in Devolutions Server 2026.3.5.0 through 2026.3.10.0 and 2026.2.20.0 and earlier allows an authenticated non-administrative user with a PAM license to create PAM sub-providers under existing AD providers via a crafted import request.
This page as .md · .json · in your agent: get_signal("CVE-2026-114487")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.