CVE-2026-110804: Devolutions Server Privilege Escalation

CVE-2026-110804 Overview

CVE-2026-110804 affects Devolutions Server 2026.3.8.0 and earlier. The flaw resides in the Privileged Access Management (PAM) checkout workflow, where Just-In-Time (JIT) elevation settings are not properly validated server-side. An authenticated user with PAM checkout access can supply crafted JIT elevation settings in a checkout update request. This allows deletion of arbitrary Active Directory (AD) groups or retention of elevated privileges beyond the intended checkout window. The weakness is classified as [CWE-915] Improperly Controlled Modification of Dynamically-Determined Object Attributes.

Critical Impact
Authenticated PAM users can delete arbitrary Active Directory groups and persist elevated privileges by manipulating client-supplied JIT elevation parameters.

Affected Products

Devolutions Server 2026.3.8.0
Devolutions Server versions prior to 2026.3.8.0
Deployments exposing PAM checkout functionality to authenticated users

Discovery Timeline

2026-10-16 - CVE CVE-2026-110804 published to NVD
2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-110804

Vulnerability Analysis

Devolutions Server exposes a PAM checkout workflow that lets authorized users temporarily elevate privileges through JIT group membership in Active Directory. The checkout update endpoint accepts JIT elevation settings from the client without enforcing authoritative server-side policy. An attacker with legitimate checkout access can modify those settings to alter which AD groups are managed during elevation. The server trusts the modified parameters and applies them against Active Directory. Impact is limited to integrity: group deletions in AD and prolonged elevation beyond approved durations. Confidentiality and availability are not directly affected per the CVSS vector.

Root Cause

The root cause is improperly controlled modification of dynamically-determined object attributes [CWE-915]. The PAM checkout update handler reads JIT elevation configuration from the request body and treats it as authoritative. Server-side authorization checks do not re-validate that the submitted JIT settings match the policy bound to the credential or user role.

Attack Vector

Exploitation requires network access to the Devolutions Server API and valid credentials with PAM checkout access. The attacker issues a checkout update request containing attacker-supplied JIT elevation settings. The server processes the request, which can trigger deletion of referenced Active Directory groups or extend elevated group membership past the sanctioned window. No user interaction is required.

No verified public proof-of-concept code is available. Refer to the Devolutions Security Advisory DEVO-2026-0036 for vendor technical details.

Detection Methods for CVE-2026-110804

Indicators of Compromise

Unexpected deletion events for Active Directory groups referenced by Devolutions PAM checkout operations.
PAM checkout update requests containing JIT elevation fields that differ from the credential's configured policy.
Users retaining membership in privileged AD groups beyond the configured checkout duration.

Detection Strategies

Correlate Devolutions Server audit logs for PAM checkout update calls with Active Directory group modification events (Event IDs 4727, 4730, 4731, 4734).
Alert on any checkout update request where the JIT elevation parameters are mutated after the initial checkout approval.
Baseline normal JIT elevation durations and flag deviations from policy on a per-credential basis.

Monitoring Recommendations

Forward Devolutions Server application and audit logs to a centralized SIEM for correlation with Active Directory domain controller logs.
Monitor for AD group deletion by service accounts tied to Devolutions PAM integrations.
Review PAM checkout session durations weekly against policy and investigate outliers.

How to Mitigate CVE-2026-110804

Immediate Actions Required

Upgrade Devolutions Server to a version later than 2026.3.8.0 as published in Devolutions Security Advisory DEVO-2026-0036.
Audit all accounts with PAM checkout access and remove unnecessary entitlements.
Review Active Directory group deletion events since the deployment of affected versions.

Patch Information

Devolutions has published a fixed release and remediation guidance in Devolutions Security Advisory DEVO-2026-0036. Apply the vendor-supplied update to Devolutions Server to enforce server-side validation of JIT elevation settings during PAM checkout updates.

Workarounds

Restrict PAM checkout access to a minimal set of trusted operators until the patch is deployed.
Limit the service account used by Devolutions PAM to the specific AD groups required for JIT elevation, preventing deletion of unrelated groups.
Shorten maximum JIT elevation durations in policy to reduce the window of persistent elevated access.

bash

# Configuration example
# Review Devolutions Server PAM checkout entitlements and tighten AD service account scope
# Replace placeholder values with your environment specifics

# 1. List users with PAM checkout access (via Devolutions PowerShell module)
Get-DSUser | Where-Object { $_.Permissions -match 'PamCheckout' }

# 2. Restrict the AD service account used by Devolutions to a dedicated OU
#    so it cannot delete groups outside the JIT scope
dsacls "OU=JIT-Managed,DC=example,DC=com" /G "DEVOLUTIONS\\svc_pam:GA"
dsacls "DC=example,DC=com" /R "DEVOLUTIONS\\svc_pam"