Description
Improper input validation in the PAM AD discovery endpoints in
Devolutions Server 2026.2.4.0 through 2026.2.7.0 allows an authenticated
user with the UserGroupsView permission to coerce server-side
authentication to an attacker-controlled host, exposing PAM provider
credentials as a NTLMv2 challenge-response, via a crafted DomainName
parameter.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Devolutions | Server | 2026.2.4.0 – < 2026.2.7.0 | 2026.2.7.0 |
Advisories 1
- WID-SEC-2026-2081 Devolutions Server: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Jun 25, 2026