The vulnerability resides in the PAM Active Directory provider of Devolutions Server 2026.3.5. An improper rule enforcement flaw allows a user who possesses PAM edit permissions to circumvent the Devolutions Gateway host ruleset, thereby granting them unauthorized access to resources beyond the intended scope.

The affected product is Devolutions Server version 2026.3.5. No other versions or variants are listed in the available data.

The CVSS score of 4.3 indicates moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to have PAM edit permissions, which suggests an internal threat vector. While the impact is limited to rule bypass, the existence of privileged permissions makes the vulnerability actionable within an organization that misconfigures or over‑privileges PAM roles.