CVE-2026-14536: Devolutions Server MFA Bypass – High Severity Authentication Flaw

Technical summary

CVE-2026-14536 is an improper enforcement vulnerability (CWE-863) in Devolutions Server's authentication policy engine. The flaw stems from inadequate validation of the default MFA policy state. When DVLS processes an invalid default MFA value during authentication, the enforcement logic fails to require the completion of the second factor, allowing authentication to succeed with only the primary credential. This is a logic-layer vulnerability rather than a cryptographic weakness, making it exploitable by any authenticated user regardless of network position. The CVSS 3.1 score of 8.8 (HIGH) reflects the high impact: an attacker with valid credentials gains complete system access with confidentiality, integrity, and authenticity compromises.

Business impact

This vulnerability undermines a critical security control for organizations using Devolutions Server as their password vault or identity platform. MFA is often the last line of defense against credential compromise; its bypass means that password breaches translate directly into full system access without requiring a second factor. For organizations managing privileged accounts through DVLS, this enables attackers to move laterally across infrastructure and access sensitive administrative functions. The risk is amplified in environments where MFA is relied upon as the primary compensating control for weaker password policies.

Affected systems

Devolutions Server version 2026.2.9.0 is confirmed vulnerable. Organizations running this version with MFA policies enforced should assume the control is not functioning as intended. Verify your Devolutions Server version in Administration > System Information. Organizations on earlier versions (pre-2026.2.9.0) or later patched releases should consult the Devolutions advisory to confirm their status. The vendor has not disclosed a publicly available patch version in accessible advisories at time of publication; contact Devolutions support for availability.

Exploitability

Exploitation requires valid user credentials—either through phishing, credential reuse, or prior compromise. An attacker cannot exploit this remotely without first obtaining legitimate login material. However, once credentials are in hand, the exploit is trivial: simply attempt login at the DVLS portal and observe whether MFA is bypassed. No special tools, no race conditions, and no guesswork are required. The barrier to exploitation is low relative to the impact, making this a high-priority remediation target for any organization with credential compromise incidents or password spraying activity.

Remediation

Apply the security update provided by Devolutions for version 2026.2.9.0. Pending patch availability, implement compensating controls: (1) enforce an independent MFA requirement at your identity provider or network access layer; (2) restrict Devolutions Server access to a VPN or Zero Trust gateway that enforces device posture and MFA separately; (3) audit login activity for accounts showing successful authentication without MFA completion, which would indicate exploitation attempts. Review and enforce strong password policies to reduce reliance on credentials alone.

Patch guidance

Verify current version and patch status via Administration > System Information in Devolutions Server. Consult the official Devolutions advisory or support portal for the specific patch version that remediates CVE-2026-14536. Test the update in a staging environment before production deployment to ensure compatibility with custom authentication rules or policy overrides. After patching, manually verify that MFA is enforced for all users with the 'MFA Required' policy enabled by testing a credential-only login attempt.

Detection guidance

Monitor Devolutions Server authentication logs for login events marked as successful but without a corresponding MFA completion entry in the audit trail. Compare 'Authentication Successful' events with 'MFA Challenge Completed' events; if logins succeed without the latter, the vulnerability may be exploited. Query the event log for users with 'MFA Required' policies who show repeated successful logins without MFA completion. Implement alerts on such patterns. Additionally, review failed MFA attempts to identify brute-force activity targeting the MFA bypass. Consider exporting and analyzing authentication logs to a SIEM for baseline establishment.

Why prioritize this

This vulnerability merits immediate prioritization due to the combination of high CVSS (8.8), low exploitability barriers (authenticated access only), and critical business impact (MFA bypass). It directly enables account takeover post-credential compromise, which is a common attack path following phishing or credential stuffing. Organizations using Devolutions Server as a centralized identity or secrets repository face amplified risk because successful exploitation grants access to all managed credentials downstream. The fact that it is not yet on the CISA KEV list does not reduce urgency—KEV listing typically lags active exploitation by weeks or months.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects: (1) Network-adjacent attack vector (valid credentials required, but no network segmentation typically enforced); (2) Low complexity (straightforward MFA bypass, no race conditions or timing attacks); (3) Low privileges required (any authenticated user, not admin-only); (4) Scope unchanged; (5) High confidentiality, integrity, and availability impact (full system access once credentials are compromised). The score appropriately conveys that this is a severe authentication failure, but does not capture organizational context—risk elevation may be warranted if MFA is your primary compensating control or if Devolutions Server is internet-facing.

Frequently asked questions