Back to overview

CVE-2026-12755

LOW
2.7
CVSS 3.1
Description
Improper input validation in the PAM AD discovery endpoints in Devolutions Server 2026.2.4.0 through 2026.2.7.0 allows an authenticated user with the UserGroupsView permission to coerce server-side authentication to an attacker-controlled host, exposing PAM provider credentials as a NTLMv2 challenge-response, via a crafted DomainName parameter.

Metadata

CVE ID
CVE-2026-12755
State
PUBLISHED
Assigner
DEVOLUTIONS
Reserved
2026-06-19 19:30 UTC
Published
2026-06-25 13:12 UTC
Last updated
2026-06-25 14:52 UTC
Primary CWE
CWE-1284
CWE-1284 Improper validation of specified quantity in input
Vendor / Product
Devolutions / Server
Sources
cve.org  ·  NVD

Severity & Metrics

2.7 LOW CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
SSVC — CISA Coordinator
Exploitation
none
Automatable
no
Tech. Impact
partial
Affected products (1)
VendorProductPlatformVersions
Devolutions Server — 2026.2.4.0 < 2026.2.7.0
Weakness (CWE)
CWESourceDescription
CWE-1284 cna CWE-1284 Improper validation of specified quantity in input
CVSS scores (1)
ScoreSeverityVersionSourceVector
2.7 LOW 3.1 adp CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
References (1)
Back to overview