Vulnerability Details CVE-2026-12755
Improper input validation in the PAM AD discovery endpoints in
Devolutions Server 2026.2.4.0 through 2026.2.7.0 allows an authenticated
user with the UserGroupsView permission to coerce server-side
authentication to an attacker-controlled host, exposing PAM provider
credentials as a NTLMv2 challenge-response, via a crafted DomainName
parameter.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 11.9%
CVSS Severity
CVSS v3 Score 2.7
Products affected by CVE-2026-12755
-
cpe:2.3:a:devolutions:devolutions_server:2026.2.4.0
-
cpe:2.3:a:devolutions:devolutions_server:2026.2.5.0
-
cpe:2.3:a:devolutions:devolutions_server:2026.2.7.0