CVE-2026-110804 in Server
Summary
by MITRE • 10/16/2026
Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with PAM checkout access to delete arbitrary Active Directory groups or retain elevated privileges via client-supplied JIT elevation settings in a checkout update request.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified involves a critical flaw within the Privileged Access Management (PAM) module of Devolutions Server, specifically affecting versions 2026.3.8.0 and earlier. This issue stems from an improper control over how Just-In-Time elevation settings are processed during the checkout phase of privileged sessions. In standard PAM workflows, users request temporary elevated privileges to perform specific administrative tasks, after which they must check out their session to release those rights back to the system for reassignment or revocation. The security architecture relies on strict validation of these state transitions to ensure that privilege elevation is both time-bound and purpose-limited. However, in this implementation, the server fails to adequately validate the parameters submitted during a checkout update request, allowing an authenticated user with PAM checkout access to manipulate the underlying configuration data associated with their session or other sessions they have permission to manage.
From a technical perspective, the core flaw lies in the lack of integrity checks on client-supplied JIT elevation settings when updating checkout states. When a user initiates a checkout operation, the system is expected to revoke elevated privileges and reset access controls according to predefined policies. Instead, the application accepts arbitrary values for these settings without sufficient verification against authorized baselines or policy constraints. This allows an attacker who has obtained valid credentials with PAM checkout permissions to send crafted requests that modify elevation parameters in ways not intended by the system administrators. By manipulating these settings during the checkout process, the user can effectively bypass the automatic revocation of elevated privileges, thereby retaining administrative rights beyond their authorized timeframe or scope.
The operational impact of this vulnerability is severe due to its potential for privilege escalation and lateral movement within an Active Directory environment. An attacker exploiting this flaw could delete arbitrary Active Directory groups, which may lead to significant disruption in identity management structures and access control lists. More critically, the ability to retain elevated privileges means that a compromised low-privileged account or a malicious insider with limited PAM checkout rights can maintain persistent administrative access. This persistence allows for long-term unauthorized activities such as data exfiltration, installation of backdoors, or further exploitation of other systems within the network without triggering standard alerting mechanisms associated with unexpected privilege usage. The attack vector is classified as remote if the Devolutions Server interface is accessible over a network, though it requires initial authentication and specific PAM checkout permissions, placing it in the category of authenticated attacks that exploit business logic flaws rather than traditional software bugs like buffer overflows or injection vulnerabilities.
This vulnerability aligns with CWE-284 Improper Access Control, as it involves failing to restrict actions based on user roles and privileges during state transitions. It also maps to MITRE ATT&CK techniques related to Privilege Escalation via Exploitation of Business Logic Flaws, specifically resembling T1078 Valid Accounts where an attacker uses legitimate credentials but abuses the system's logic to gain higher-level access. The persistence mechanism described resembles aspects of T1543 Create or Modify System Process through malicious configuration changes, although in this case, it is achieved by manipulating session state rather than installing a service directly.
Mitigation strategies should prioritize immediate patching to version 2026.3.8.1 or later where the validation logic for JIT elevation settings has been corrected. In environments where upgrading is not immediately feasible, administrators should enforce strict role-based access controls (RBAC) by limiting PAM checkout permissions only to highly trusted senior administrators who require such capabilities. Additionally, implementing comprehensive logging and monitoring of all checkout operations can help detect anomalous behavior indicative of exploitation attempts. Security teams should review audit logs for any unusual patterns in privilege retention or group modifications following checkout events. Regular audits of Active Directory group memberships and JIT policy configurations are also recommended to identify any unauthorized changes that may have occurred prior to remediation.