CVE-2026-12755: Devolutions Server

Low severity, CVSS 2.7. EPSS: 0.4% chance of exploitation in the next 30 days.

Improper input validation in the PAM AD discovery endpoints in Devolutions Server 2026.2.4.0 through 2026.2.7.0 allows an authenticated user with the UserGroupsView permission to coerce server-side authentication to an attacker-controlled host, exposing PAM provider credentials as a NTLMv2 challenge-response, via a crafted DomainName parameter.

Affected products

• Devolutions Devolutions Server: from 2026.2.4.0, before 2026.2.9.0 (fixed in 2026.2.9.0)

Published 2026-06-25. Last modified 2026-06-29.