Authorization Bypass Vulnerability in Devolutions Server by Devolutions

CVE-2026-114486

What is CVE-2026-114486?

The vulnerability in Devolutions Server arises from incorrect authorization mechanisms during the token generation process. This flaw allows an authenticated user without administrative privileges to circumvent established Network Access Rules within a virtual gateway, enabling unauthorized access to restricted hosts. This vulnerability is specifically present in Devolutions Server version 2026.3.10.0 and earlier, where malicious actors can exploit wildcard additional destinations signed into the gateway token.

References