CVE-2026-12755: Devolutions Server PAM Credential Exposure via AD Discovery Endpoint

Technical summary

CVE-2026-12755 is an improper input validation vulnerability (CWE-1284) in Devolutions Server's PAM AD discovery endpoints. The flaw allows an authenticated attacker with UserGroupsView permission to craft a malicious DomainName parameter that coerces the server into initiating NTLM authentication to an attacker-controlled host. This results in the server transmitting NTLMv2 challenge-response data that contains or exposes PAM provider credentials, enabling credential capture and potential offline cracking of the hash.

Business impact

The exposure of PAM provider credentials represents a significant privilege escalation pathway. Compromise of privileged account credentials managed through PAM can lead to lateral movement, access to critical infrastructure, and potential regulatory violations if those credentials are used to access sensitive systems or data. However, the attack requires both authenticated access and specific role permissions, limiting the immediate blast radius to insider threats or accounts already compromised with moderate privileges.

Affected systems

Devolutions Server versions 2026.2.4.0 through 2026.2.7.0 are affected. Organizations should verify their exact Devolutions Server version and check whether any running instances fall within this range. Older and newer versions outside this band should be verified against the official Devolutions advisory to confirm their status.

Exploitability

Exploitation requires an authenticated user account with the UserGroupsView permission—it is not a zero-day or unauthenticated attack vector. The attacker must also be able to host or control a network destination that the vulnerable server can reach. The CVSS score of 2.7 (LOW) reflects the high barrier to entry: authentication is mandatory, specific permissions are required, and no user interaction is needed. This limits practical risk to environments where insider threat or lateral movement from a compromised account is already a concern.

Remediation

Apply the patch version released by Devolutions to address this vulnerability. Organizations should verify against the official Devolutions advisory which patch version resolves CVE-2026-12755. As an interim control, restrict the UserGroupsView permission to only users who have a legitimate business need, and monitor for suspicious AD discovery endpoint activity or attempts to modify DomainName parameters to external hosts.

Patch guidance

Check the Devolutions advisory or security bulletin for the specific patch version that remediates this issue. Apply patches during a maintenance window to Devolutions Server instances. Verify post-patch that PAM AD discovery functionality continues to operate as expected and that no stale NTLMv2 hashes remain in memory or logs. Document the patched version in your asset inventory.

Detection guidance

Monitor Devolutions Server logs for unusual AD discovery endpoint activity, particularly requests containing unexpected or external DomainName values. Look for authentication attempts initiated by the server to hosts outside your normal Active Directory infrastructure. If available, enable debug logging on PAM provider authentication flows and review for unexplained NTLM handshakes. Review user accounts with UserGroupsView permissions and audit access patterns to ensure least-privilege assignment.

Why prioritize this

Despite the LOW CVSS score, this vulnerability merits attention in environments where Devolutions Server manages critical privileged access. The attack path is constrained by authentication and role requirements, but successful exploitation directly exposes PAM credentials—the crown jewels of privilege management. Prioritize patching in deployments where PAM is used to control access to high-value targets (databases, directory services, cloud platforms). Lower priority for isolated lab or low-risk instances.

Risk score, explained

The CVSS 3.1 score of 2.7 reflects low network attack surface (requires authentication, high privilege level, no user interaction needed, no impact to system integrity or availability, and confidentiality impact limited to PAM provider credentials). The 'LOW' severity categorization is mathematically accurate but may understate business risk in contexts where those credentials unlock critical systems. Security leaders should not use CVSS alone to make remediation decisions; consider the sensitivity of the PAM-protected assets in your environment.

Frequently asked questions