---
id: "CVE-2026-119636"
kind: "vulnerability"
aliases: ["CVE-2026-119636"]
title: "Devolutions Server: expired PAM checkouts keep account access after checkout ends"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["devolutions-server", "package", "pam", "windows"]
not_affected_if: ["no-pam-checkouts", "versions-outside-range"]
published_at: "2026-11-03T21:17:02+00:00"
first_seen_at: "2026-11-03T21:19:08+00:00"
updated_at: "2026-11-03T21:27:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119636", "first_seen_at": "2026-11-03T21:19:08+00:00"}]
---

# Devolutions Server: expired PAM checkouts keep account access after checkout ends

Devolutions Server 2025.3.2.0 through 2026.2.22.0 fails to check in expired privileged account checkouts when there is a backlog of 21 or more newer active checkouts. An authenticated user with checkout rights keeps access to the target account after the checkout should have expired, and its password is not rotated.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the installed Devolutions Server version is within `2025.3.2.0` through `2026.2.22.0`.
- Review PAM checkout logs for expired checkouts that were never checked in or rotated while many newer checkouts were active.

## Fix

- Devolutions Server versions after `2026.2.22.0` are reported as affected-range boundary; the exact fixed version is unknown from the sources.

## Timeline

- 2026-11-03T21:19:08+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119636

## From the sources

Improper release of expired privileged access checkouts in the PAM scheduled check-in task in Devolutions Server 2025.3.2.0 through 2026.2.22.0 allows an authenticated user with checkout rights on a PAM account to retain access to that account on the target system after the checkout expires via a backlog of 21 or more newer active checkouts that prevents the expired checkout from being checked in and its password from being rotated.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_