Live › vulnerability › CVE-2026-119636
Devolutions Server 2025.3.2.0 through 2026.2.22.0 fails to check in expired privileged account checkouts when there is a backlog of 21 or more newer active checkouts. An authenticated user with checkout rights keeps access to the target account after the checkout should have expired, and its password is not rotated.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Teams that run Devolutions Server with the PAM feature and let users check out privileged accounts. The exposure needs a backlog of 21 or more active checkouts, so smaller deployments are less likely to be hit. unknown whether other Devolutions products are affected.
No product ranges from the sources yet.
2025.3.2.0 through 2026.2.22.0.2026.2.22.0 are reported as affected-range boundary; the exact fixed version is unknown from the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper release of expired privileged access checkouts in the PAM scheduled check-in task in Devolutions Server 2025.3.2.0 through 2026.2.22.0 allows an authenticated user with checkout rights on a PAM account to retain access to that account on the target system after the checkout expires via a backlog of 21 or more newer active checkouts that prevents the expired checkout from being checked in and its password from being rotated.
This page as .md · .json · in your agent: get_signal("CVE-2026-119636")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.