Skip to content
CVE PROGRAM SOURCE RECORD2.7 Low

CVE-2026-12755

Improper input validation in the PAM AD discovery endpoints in

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
DEVOLUTIONS

Description

Improper input validation in the PAM AD discovery endpoints in Devolutions Server 2026.2.4.0 through 2026.2.7.0 allows an authenticated user with the UserGroupsView permission to coerce server-side authentication to an attacker-controlled host, exposing PAM provider credentials as a NTLMv2 challenge-response, via a crafted DomainName parameter.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Devolutions Server

Default version status: unaffected

  • 2026.2.4.0 to < 2026.2.7.0affected

References