The flaw lies in the handling of Just‑In‑Time (JIT) elevation settings during a PAM checkout update in Devolutions Server versions 2026.3.8.0 and earlier. An authenticated user with PAM checkout permissions can supply malicious JIT settings that enable the deletion of arbitrary Active Directory groups or the retention of elevated privileges. Because the settings are not validated, the attacker can remove security groups or maintain higher privileges without authorization, bypassing access controls and compromising the integrity and availability of the AD environment.

Affected are deployments of Devolutions Server 2026.3.8.0 and any earlier release. The functionality is tied to the PAM checkout component that interfaces with Active Directory.

The CVSS score of 4.3 classifies the vulnerability as moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed exploitation. Nonetheless, the attack requires an authenticated user with PAM checkout access, which is typically held by administrators, and could lead to unauthorized deletion of AD groups and retention of elevated privileges.