CVE-2026-93330

PAM Rule Enforcement Bypass in Devolutions Server 2026.3.5

Published Sep 29, 2026 CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Description

Improper rule enforcement in the PAM Active Directory provider in Devolutions Server 2026.3.5 allows a user with PAM edit permissions to bypass the Devolutions Gateway host ruleset.

Analysis

Technical impact

The vulnerability resides in the PAM Active Directory provider of Devolutions Server 2026.3.5. An improper rule enforcement flaw allows a user who possesses PAM edit permissions to circumvent the Devolutions Gateway host ruleset, thereby granting them unauthorized access to resources beyond the intended scope.

Affected Systems

The affected product is Devolutions Server version 2026.3.5. No other versions or variants are listed in the available data.

Risk and Exploitability

The CVSS score of 4.3 indicates moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to have PAM edit permissions, which suggests an internal threat vector. While the impact is limited to rule bypass, the existence of privileged permissions makes the vulnerability actionable within an organization that misconfigures or over‑privileges PAM roles.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Devolutions

Server

unaffected

Version	Status	Constraints
`0`	affected	< 2026.3.7.0

No data.

Vendor Product Versions

Devolutions

Server

Version	Status	Scheme	Platform
`[0,2026.3.7.0)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest official patch for Devolutions Server that addresses the PAM rule enforcement flaw
Restrict PAM edit permissions only to trusted administrators and prevent ordinary users from enabling them
Review and audit gateway host rules to verify that enforcement behaves as expected

Generated by OpenCVE AI on September 30, 2026 at 01:57 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.191% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://devolutions.net/security/advisories/DEVO-2026-0034/

History

Sep 30, 2026 2:15 AM Title updated View changes

Type	Values Removed	Values Added
Title		PAM Rule Enforcement Bypass in Devolutions Server 2026.3.5

Sep 29, 2026 5:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Devolutions Devolutions server
Vendors & Products		Devolutions Devolutions server

Sep 29, 2026 5:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 29, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}`

Sep 29, 2026 3:30 PM Description updated. Weaknesses updated. Added references View changes

Type	Values Removed	Values Added
Description		Improper rule enforcement in the PAM Active Directory provider in Devolutions Server 2026.3.5 allows a user with PAM edit permissions to bypass the Devolutions Gateway host ruleset.
Weaknesses		CWE-696
References		https://devolutions.net/security/advisories/DEVO-2026-0034/