Improper Access Control in Devolutions Server by Devolutions

CVE-2026-119636

What is CVE-2026-119636?

In Devolutions Server, a flaw in the scheduled check-in task allows users with privileged checkout rights to maintain access to accounts beyond the intended time frame. This occurs when a backlog of 21 or more active checkouts prevents the expired access from being properly checked in, thereby hindering the password rotation process. The issue affects versions 2025.3.2.0 through 2026.2.22.0 and poses serious risks for account security and management. For further details, refer to the Devolutions Security Advisory.

References