CVE-2026-12755CWE-1284

Improper input validation in the PAM AD discovery endpoints in Devolutions Server 2026.2.4.0 through 2026.2.7.0 allows an authenticated user with the…

Low · published June 25, 2026

CVSS v3.1
2.7
EPSS
0%
Percentile
29.1
In the wild
Unconfirmed
What it is

Improper input validation in the PAM AD discovery endpoints in

Devolutions Server 2026.2.4.0 through 2026.2.7.0 allows an authenticated

user with the UserGroupsView permission to coerce server-side

authentication to an attacker-controlled host, exposing PAM provider

credentials as a NTLMv2 challenge-response, via a crafted DomainName

parameter.

The record
Technical detail
CVSS v3.1
2.7 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00365 · 29.1th percentile
Weakness
CWE-1284 · Improper Validation of Specified Quantity in Input
Published
2026-06-25T13:12Z
EPSS history
Timeline
  • 25 JUN 13:12Z
    Improper input validation in the PAM AD discovery endpoints in Devolutions Server 2026.2.4.0 through 2026.2.7.0 allows an authenticated user with the…
    cvelistv5