CVE-2026-9226: Devolutions Server

Medium severity, CVSS 6.8. EPSS: 0.2% chance of exploitation in the next 30 days.

Authentication bypass in the Azure AD external login flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account via replay of a captured login-session token exposed in a redirect URL.

Affected products

• Devolutions Server: before 2026.3.8 (fixed in 2026.3.8)

Published 2026-10-06. Last modified 2026-10-07.