Improper neutralization of special elements in the built-in PAM provider password rotation templates allows an authenticated user with write access to a vault to execute arbitrary commands on the systems managed by the affected PAM provider. This flaw enables the attacker to run any shell command with the privileges of the PAM provider service, compromising confidentiality, integrity, and availability of the managed target systems.

The vulnerability affects Devolutions Server versions 2026.2.4.0 and 2026.1.20.0, as well as all earlier releases. The affected product is Devolutions:Server, delivering privileged access management capabilities to enterprise environments.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is not available, so the overall exploitation probability cannot be precisely quantified. However, the flaw is listed in CISA’s KEV catalog as not listed, indicating no known active exploitation at this time. The attack vector requires an authenticated user with write permissions to a vault, meaning the threat is limited to trusted internal users or compromised accounts. Once executed, the attacker can achieve full command‑execution privilege on any managed host through the PAM provider.