CVE-2026-11890: Devolutions Server Account Discovery Access Control Flaw

Technical summary

CVE-2026-11890 is an improper access control vulnerability (CWE-284, CWE-882) in Devolutions Server's PAM account discovery functionality. The vulnerability allows authenticated users to bypass authorization checks and retrieve account discovery scan results. The flaw stems from inadequate access control enforcement on discovery result endpoints, enabling any authenticated account to query sensitive enumeration data regardless of role or permission level. This is a classic broken access control issue where the application fails to properly validate user permissions before returning sensitive data.

Business impact

Account discovery scan results typically contain enumerated usernames, system accounts, and service credentials discovered during automated reconnaissance. Unauthorized disclosure of this data could expose the organization's account inventory to internal threats or compromised accounts. An attacker who gains legitimate access to Devolutions Server can now escalate information gathering beyond their intended scope, potentially identifying high-value targets, service accounts, or privileged user names for further exploitation. This undermines the principle of least privilege and expands the blast radius of any credential compromise.

Affected systems

Devolutions Server 2026.2.5 and 2026.1.21 are confirmed affected. Organizations running these versions should inventory their deployments immediately. Earlier and later versions may also be affected—verify against the official Devolutions advisory for the complete supported version matrix and any backported fixes.

Exploitability

Exploitation requires valid authentication to Devolutions Server; unauthenticated access is not possible. However, the barrier is low: any user account with basic access (even unprivileged roles) can trigger the vulnerability. Attack complexity is minimal—no special network conditions or user interaction is required. An attacker with compromised or stolen credentials, insider threats, or legitimate but malicious users can exploit this immediately upon login. The vulnerability has a CVSS 3.1 score of 4.3 (MEDIUM), reflecting moderate risk.

Remediation

Apply the patched versions released by Devolutions. Verify with the Devolutions security advisory for the exact patch versions addressing this vulnerability. Until patching is complete, implement compensating controls: restrict Devolutions Server access to trusted networks or VPN; limit authentication to administrative accounts only; monitor account discovery scan activity and access patterns for anomalies; and audit user permissions regularly to ensure least-privilege enforcement.

Patch guidance

Check Devolutions' official security advisory for patched versions that address CVE-2026-11890. Apply updates to all affected instances. Test patches in a non-production environment first, particularly if Devolutions Server is critical to your PAM operations. Schedule maintenance windows to minimize operational disruption. After patching, re-validate access controls on account discovery results to ensure the fix has been applied correctly.

Detection guidance

Monitor Devolutions Server access logs for account discovery scan result queries from unexpected user accounts or roles. Alert on access by non-administrative users to discovery scan endpoints or APIs. Check for repetitive or bulk queries of discovery results that may indicate enumeration. Review user activity reports in Devolutions Server to identify which accounts have accessed sensitive scan data. Implement audit logging at the API level if available and correlate with identity and access management (IAM) activity to detect lateral privilege escalation patterns.

Why prioritize this

While the CVSS score is MEDIUM (4.3), prioritize this vulnerability based on your organization's sensitivity to account inventory exposure and the prevalence of Devolutions Server in your PAM infrastructure. If account discovery scans contain production credentials or high-value system accounts, this rises in priority despite the moderate score. Insider threat risk and credential reuse in your environment should inform your timeline. Organizations with strict compliance requirements around data classification and access controls should treat this as higher urgency.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects a network-accessible vulnerability (AV:N) that requires low attack complexity (AC:L) and authentication (PR:L), resulting in low confidentiality impact (C:L) with no integrity or availability impact. The score appropriately captures that this is an information disclosure issue requiring valid credentials, not a remote code execution or system compromise. However, the business impact may be higher than the base score suggests if discovery scans contain sensitive credentials—consider context-specific risk scoring based on what data your scans reveal.

Frequently asked questions