CVE-2026-114486 in Server
Summary
by MITRE • 10/22/2026
Incorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3.10.0 and earlier allows an authenticated non-administrative attacker to bypass the Network Access Rules of a virtual gateway and reach denied hosts via wildcard additional destinations signed into the gateway token.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified as incorrect authorization in Devolutions Gateway token generation represents a critical flaw within the access control mechanisms of Devolutions Server versions 2026.3.10.0 and earlier. This issue specifically affects the process by which authentication tokens are generated for virtual gateways, allowing an authenticated non-administrative user to circumvent established Network Access Rules. In typical enterprise environments, these rules serve as a primary defense layer, restricting users from accessing specific hosts or network segments based on their role or clearance level. The flaw arises because the token generation logic fails to properly validate and enforce these restrictions when constructing wildcard additional destinations that are signed into the gateway token. Consequently, the resulting token contains permissions that exceed what is authorized for the user's account, effectively granting them access to resources they should be denied by policy.
From a technical perspective, this vulnerability stems from an improper validation of authorization constraints during the creation of session tokens. When a non-administrative user initiates a connection through a virtual gateway, the system generates a token that includes destination information. Ideally, this process should filter out any destinations prohibited by the configured Network Access Rules. However, due to the logic error, wildcard entries for additional destinations are included in the signed token without sufficient verification against the user's specific access rights. This allows the attacker to leverage these unauthorized wildcards to route traffic through the gateway to hosts that were explicitly blocked by administrative policies. The attack does not require privilege escalation or exploitation of a separate software flaw; it relies solely on the misuse of legitimate authentication and authorization processes, making it particularly difficult to detect using standard intrusion detection systems that focus on signature-based threats rather than logic errors.
The operational impact of this vulnerability is significant for organizations relying on Devolutions Server for secure remote access management. An authenticated non-administrative attacker can bypass network segmentation controls, potentially gaining unauthorized access to sensitive internal resources such as databases, administrative consoles, or proprietary application servers. This breach of isolation undermines the principle of least privilege and compromises the integrity of the organization's security architecture. If the denied hosts contain critical infrastructure or confidential data, the attacker could exfiltrate information, install malware, or use these systems as a pivot point for further lateral movement within the network. The ability to bypass access rules effectively nullifies one of the primary controls intended to limit the blast radius of a compromised account, thereby increasing the risk of widespread compromise even from low-level user credentials.
This vulnerability aligns with CWE-269, which describes Improper Privilege Management, specifically in the context where an actor is granted privileges or access rights that exceed their assigned role. It also maps to MITRE ATT&CK technique T1078, Valid Accounts, as the attacker utilizes legitimate credentials but exploits a flaw in how those accounts are authorized for specific actions. Furthermore, it relates to CWE-264, Permissions, Privileges, and Access Controls, highlighting a failure in enforcing access control policies during resource interaction. To mitigate this risk, organizations running affected versions of Devolutions Server must apply the vendor-provided security patch immediately upon availability. Until patches are applied, administrators should review Network Access Rules to ensure they are as restrictive as possible, avoiding overly permissive wildcard configurations where feasible. Additionally, implementing strict monitoring and logging for token generation events can help detect anomalous behavior indicative of this exploitation attempt. Regular audits of user permissions and access logs will further aid in identifying any unauthorized attempts to leverage these flawed tokens.