Input Validation Flaw in Devolutions Server Affects User Credential Security
CVE-2026-12755

2.7LOW

Key Information:

Vendor

Devolutions

Status
Server
Vendor
CVE Published:
25 June 2026

What is CVE-2026-12755?

An input validation flaw in the PAM AD discovery endpoints of Devolutions Server versions 2026.2.4.0 to 2026.2.7.0 allows authenticated users with UserGroupsView permission to manipulate server-side authentication processes. This vulnerability can lead to the exposure of PAM provider credentials in the form of an NTLMv2 challenge-response when a malicious actor crafts a specific DomainName parameter, potentially compromising sensitive user information.

Affected Version(s)

Server 2026.2.4.0 < 2026.2.7.0

References

https://devolutions.net/security/advisories/DEVO-2026-0020/

CVSS V3.1

Score:
2.7
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.