CVE-2026-100289: Devolutions Server Privilege Escalation

CVE-2026-100289 Overview

CVE-2026-100289 is a missing authorization vulnerability [CWE-862] in the gateway network scan token API of Devolutions Server. The flaw affects Devolutions Server versions 2026.3.5.0 and earlier. An authenticated low-privileged user can generate a network scan token through a crafted API request. This token permits internal network discovery and port scanning through the gateway. The issue lets attackers reach network segments they should not enumerate. Devolutions published advisory DEVO-2026-0034 describing the issue.

Critical Impact
Any authenticated low-privileged Devolutions Server user can pivot through the gateway to map internal networks and enumerate open ports on hosts that are not otherwise reachable.

Affected Products

Devolutions Server 2026.3.5.0 and earlier
Gateway network scan token API component
Deployments exposing gateway-managed internal networks

Discovery Timeline

2026-09-29 - CVE-2026-100289 published to NVD
2026-09-29 - Last updated in NVD database
Advisory - Devolutions published Devolutions Security Advisory DEVO-2026-0034

Technical Details for CVE-2026-100289

Vulnerability Analysis

The gateway network scan token API in Devolutions Server fails to enforce authorization checks against the requesting user's role. The API is designed to issue short-lived tokens that authorize a gateway-mediated network scan. In vulnerable builds, the endpoint verifies authentication but omits role or permission validation. A low-privileged account can therefore request a scan token and use it to drive discovery through the gateway. Because scans traverse the gateway, they reach internal hosts that the user cannot contact directly. This turns Devolutions Server into a pivot for reconnaissance across otherwise segmented networks.

Root Cause

The defect maps to CWE-862 (Missing Authorization). The scan token endpoint checks that the caller has a valid session but does not confirm that the caller holds the privileges required to initiate network scanning. Authorization logic that gates administrative or network-facing operations is absent from this code path.

Attack Vector

Exploitation requires network access to the Devolutions Server API and valid low-privileged credentials. The attacker sends a crafted API request to the gateway network scan token endpoint. The server returns a scan token without verifying the caller's role. The attacker then uses the token to drive the gateway to perform host discovery and TCP port scans against internal targets. Results reveal live hosts, open services, and network topology usable for follow-on attacks.

// No verified exploit code is public.
// See Devolutions advisory DEVO-2026-0034 for technical details.

Detection Methods for CVE-2026-100289

Indicators of Compromise

Requests from low-privileged accounts to the gateway network scan token API endpoint in Devolutions Server logs.
Gateway-initiated TCP connections to internal hosts and ports that do not match documented administrative scan windows.
Bursts of short-duration connection attempts across sequential ports or IP ranges originating from the Devolutions gateway.

Detection Strategies

Audit Devolutions Server API access logs for scan token issuance events correlated with non-administrator user identities.
Alert on gateway hosts generating outbound scan patterns such as SYN sweeps or sequential port probes.
Cross-reference scan activity with the requesting user's role assignments to surface privilege mismatches.

Monitoring Recommendations

Forward Devolutions Server and gateway logs to a central analytics platform and retain them for privilege-abuse investigations.
Baseline normal gateway scan volume and frequency, then alert on deviations.
Monitor internal network sensors for reconnaissance traffic originating from the gateway's IP address.

How to Mitigate CVE-2026-100289

Immediate Actions Required

Upgrade Devolutions Server to the fixed release identified in Devolutions Security Advisory DEVO-2026-0034.
Review Devolutions Server user roles and remove accounts that do not require gateway or scanning privileges.
Rotate credentials for low-privileged accounts that had access to the affected API.

Patch Information

Devolutions addresses the missing authorization in versions released after 2026.3.5.0. Consult Devolutions Security Advisory DEVO-2026-0034 for the exact fixed build and upgrade procedure.

Workarounds

Restrict Devolutions Server API access to trusted management networks using firewall or reverse-proxy allowlists.
Limit gateway reachability so scan operations cannot traverse sensitive network segments until the patch is applied.
Enable detailed audit logging on the Devolutions Server API and review scan token issuance events daily.

bash

# Example: restrict Devolutions Server API to a management subnet
# Replace 10.10.0.0/24 with your management network
iptables -A INPUT -p tcp --dport 443 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP