CVE-2026-4925
MediumCVSS 5.0Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
Devolutions Server versions 2026.1.6 through 2026.1.11 have improper access control in the users MFA feature. An authenticated user can bypass administrator-enforced restrictions and remove their own multi-factor authentication (MFA) configuration via a crafted request.
Risk Assessment
Bypassing MFA weakens account security and may allow an attacker easier access to the system if the password is compromised. This could lead to unauthorized access to protected resources.
Recommendation
Update Devolutions Server to a version newer than 2026.1.11 that fixes the vulnerability. Until then, monitor for unusual MFA configuration changes and verify user permissions.
Other vulnerabilities in Devolutions Server
See all- CVE-2026-93330Medium
In Devolutions Server 2026.3.5, improper rule enforcement in the PAM Active Directory provider allows a user with PAM edit permissions to bypass the Devolutions Gateway host ruleset.
- CVE-2026-100289Medium
In Devolutions Server 2026.3.5.0 and earlier, missing authorization in the gateway network scan token API allows an authenticated low-privileged user to generate a network scan token and perform internal network discovery and port scanning through the gateway via a crafted API request.
- CVE-2026-100287Medium
In Devolutions Server 2026.3.5.0 and earlier, missing authorization in the attachment history API allows an authenticated low-privileged user to permanently delete or restore vault attachments via a crafted API request.
- CVE-2026-100286Medium
In Devolutions Server 2026.3.5.0 and earlier, missing authorization in the data source settings API allows an authenticated non-administrative user to disclose integration secrets via a crafted API request.
- CVE-2026-114487Medium
Missing authorization in the PAM AD computer import endpoint in Devolutions Server 2026.3.5.0 through 2026.3.10.0 and 2026.2.20.0 and earlier allows an authenticated non-administrative user with a PAM license to create PAM sub-providers under existing AD providers via a crafted import request.
- CVE-2026-114486Medium
Incorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3.10.0 and earlier allows an authenticated non-administrative attacker to bypass the Network Access Rules of a virtual gateway and reach denied hosts via wildcard additional destinations signed into the gateway token.
- CVE-2026-114485Medium
Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlier allows an authenticated attacker with delegated user view permissions to obtain the MFA secrets of all users via the user list API response.
- CVE-2026-110806Medium
Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with only View permission to obtain add-on passwords via the unredacted add-on properties returned in connection data.
- CVE-2026-110805Low
Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate the stored PingOne application secret via an attacker-controlled PingOne configuration in the request parameter.
- CVE-2026-110804Medium
Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with PAM checkout access to delete arbitrary Active Directory groups or retain elevated privileges via client-supplied JIT elevation settings in a checkout update request.
Original NVD description (English source)
Improper access control in the users MFA feature in Devolutions Server allows an authenticated user to bypass administrator-enforced restrictions and remove their own multi-factor authentication (MFA) configuration via a crafted request. This issue affects Server: from 2026.1.6 through 2026.1.11.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS