VYPR
← All advisories
Low severity2.7NVD Advisory· Published Jun 25, 2026· Updated Jun 29, 2026

CVE-2026-12755

CVE-2026-12755

Description

Improper input validation in the PAM AD discovery endpoints in Devolutions Server 2026.2.4.0 through 2026.2.7.0 allows an authenticated user with the UserGroupsView permission to coerce server-side authentication to an attacker-controlled host, exposing PAM provider credentials as a NTLMv2 challenge-response, via a crafted DomainName parameter.

Affected products

2
  • Devolutions/Server2 versions
    cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*range: >=2026.2.4.0,<2026.2.9.0
    • (no CPE)range: 2026.2.4.0-2026.2.7.0

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.