Authorization Flaw in Devolutions Server Affects PAM License Holders

CVE-2026-114487

What is CVE-2026-114487?

An authorization flaw in the Devolutions Server's PAM AD computer import endpoint allows authenticated non-administrative users with a PAM license to exploit the system. This vulnerability enables them to create PAM sub-providers under existing Active Directory providers through a specially crafted import request, raising significant concerns regarding unwanted access and control over directory services.

References