Skip to content
OpenAdvisories
High · 8.8 CVE-2026-119636 EUVD-2026-116494GHSA-v65m-vc6q-3v2c

Improper release of expired privileged access checkouts in the PAM scheduled check-in task in Devolutions Server 2025.3.2.0 through 2026.2.…

Published Nov 3, 2026 · Updated Nov 6, 2026 · Assigned by DEVOLUTIONS

Description

Improper release of expired privileged access checkouts in the PAM scheduled check-in task in Devolutions Server 2025.3.2.0 through 2026.2.22.0 allows an authenticated user with checkout rights on a PAM account to retain access to that account on the target system after the checkout expires via a backlog of 21 or more newer active checkouts that prevents the expired checkout from being checked in and its password from being rotated.

Affected products

VendorProductAffectedFixed
Devolutions Server 2025.3.2.0 – < 2026.2.23.0 2026.2.23.0

Advisories 1

References