Skip to content
CVE PROGRAM SOURCE RECORD7.3 High

CVE-2026-14536

Improper enforcement of a mandatory multi-factor authentication policy in Devolutions Server 2026.2.9.0 allows an attacker with valid user credentials to bypass the MFA Required po

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
DEVOLUTIONS

Description

Improper enforcement of a mandatory multi-factor authentication policy in Devolutions Server 2026.2.9.0 allows an attacker with valid user credentials to bypass the MFA Required policy and authenticate without completing multi-factor authentication. The problem occurs when DVLS encounters an invalid default MFA value.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Devolutions Server

Default version status: unaffected

  • 2026.2.4 to < 2026.2.9affected

References