CVE-2026-110804: vulnerability facts

CVE-2026-110804

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with PAM checkout access to delete arbitrary Active Directory groups or retain elevated privileges via client-supplied JIT elevation settings in a checkout update request.

CVSS 4.3 · Medium · EPSS 0.2% · Fix available

Published: 2026-10-16T13:45:38.143Z
Updated: 2026-10-16T15:08:54.643Z

Affected products and versions

server
Versions
- ≥ 0, < 2026.3.10: Affected (custom)
Update to 2026.3.10

Original sources

https://devolutions.net/security/advisories/DEVO-2026-0036/
https://nvd.nist.gov/vuln/detail/CVE-2026-110804

Check your server →