CVE-2026-119636 in Server
Summary
by MITRE • 11/03/2026
Improper release of expired privileged access checkouts in the PAM scheduled check-in task in Devolutions Server 2025.3.2.0 through 2026.2.22.0 allows an authenticated user with checkout rights on a PAM account to retain access to that account on the target system after the checkout expires via a backlog of 21 or more newer active checkouts that prevents the expired checkout from being checked in and its password from being rotated.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified as an improper release of expired privileged access checkouts within Devolutions Server represents a critical flaw in the Privileged Access Management (PAM) session lifecycle management logic. Specifically, this issue resides in the scheduled check-in task responsible for reclaiming control over sensitive accounts after authorized sessions conclude. In a properly functioning PAM environment, when an administrator or service account checks out credentials from the vault to access a target system, that checkout is assigned a strict expiration time. Upon reaching this timestamp, the system must automatically force-check in the session and rotate the associated password to ensure security continuity. However, in versions of Devolutions Server ranging from 2025.3.2.0 through 2026.2.22.0, this automated reclamation mechanism fails under specific concurrency conditions. The flaw is triggered when a backlog of twenty-one or more newer active checkouts exists for the same target account. This queue depth prevents the system from processing the expiration event for the older checkout, effectively leaving the expired session in an active state despite its time limit having passed.
From a technical perspective, this behavior indicates a race condition or resource contention issue within the backend service that manages access requests and password rotation schedules. The PAM engine appears to prioritize newer checkouts over the cleanup of expired ones when the queue exceeds a specific threshold, likely due to how the scheduler iterates through pending tasks or locks resources during high-load scenarios. Consequently, an authenticated user who possesses checkout rights on a targeted PAM account can exploit this delay by initiating multiple subsequent checkouts after their initial session expires. By maintaining a sufficient number of active sessions in the queue, they effectively block the system from recognizing and processing the expiration of their original session. This results in the retention of valid credentials for an indefinite period, bypassing the intended time-bound restrictions designed to limit exposure windows for privileged access.
The operational impact of this vulnerability is severe, as it directly undermines the core security principles of least privilege and temporary access that define effective PAM solutions. An attacker or malicious insider with legitimate checkout permissions can maintain persistent administrative control over critical infrastructure components without detection by standard session monitoring tools that rely on expiration timestamps. This prolonged access allows for unauthorized configuration changes, data exfiltration, or lateral movement within the network environment. Furthermore, because the password rotation mechanism is blocked, any credentials compromised during this extended window remain valid until manually intervened upon by an administrator. This creates a significant blind spot in audit trails and compliance reporting, as the system records the session as active rather than expired, potentially violating regulatory requirements for strict access control auditing such as those found in PCI DSS or HIPAA frameworks.
This vulnerability aligns with CWE-250, which describes ownership loss of critical data or resources due to improper release mechanisms, and can be mapped to MITRE ATT&CK technique T1078, specifically the Valid Accounts subcategory where attackers leverage legitimate credentials for unauthorized access. The failure to enforce session expiration constitutes a breakdown in identity governance controls. To mitigate this risk, organizations running affected versions of Devolutions Server must apply the vendor-provided patch immediately upon availability. In addition to software updates, administrators should implement strict monitoring on PAM checkout queues and set alerts for high volumes of concurrent checkouts against single accounts. Regular audits of active sessions versus their scheduled expiration times can help identify instances where this backlog condition has occurred previously. Ensuring that automated password rotation policies are enforced independently of the checkout queue status is also recommended to minimize the window of opportunity should such a concurrency issue arise in other systems or future versions.