CVE-2026-7325: Devolutions Server Auth Bypass Vulnerability

CVE-2026-7325 Overview

CVE-2026-7325 is an improper authorization vulnerability in the Active Directory browsing feature of Devolutions Server. A low-privileged authenticated user can coerce the server to authenticate to an attacker-controlled endpoint. This authentication relay exposes the credential material of a stored Privileged Access Management (PAM) provider service account. The flaw is classified under CWE-918 (Server-Side Request Forgery). Devolutions published advisory DEVO-2026-0013 covering this issue.

Critical Impact
Authenticated low-privileged users can capture authentication material tied to a PAM service account, enabling lateral movement and privileged credential abuse within the Devolutions Server deployment.

Affected Products

Devolutions Server versions 2026.1.6.0 through 2026.1.16.0
Devolutions Server 2025.3.20.0 and earlier
Devolutions Server Active Directory browsing feature with stored PAM providers

Discovery Timeline

2026-05-22 - CVE-2026-7325 published to NVD
2026-05-22 - Last updated in NVD database
2026-05-22 - Devolutions publishes security advisory DEVO-2026-0013

Technical Details for CVE-2026-7325

Vulnerability Analysis

The vulnerability resides in the Active Directory (AD) browsing feature of Devolutions Server. The feature allows users to query AD resources using a stored PAM provider service account. Authorization checks do not properly validate the target of the AD browsing request. An authenticated user with low privileges can direct the server to perform authentication against an arbitrary host. The server then transmits authentication material associated with the PAM service account to that host.

The attack maps to CWE-918, Server-Side Request Forgery. While the network attack vector is exposed, exploitation requires authentication and the attack complexity is high. A scope change occurs because the captured credentials affect resources beyond the Devolutions Server itself.

Root Cause

The AD browsing handler does not restrict which directory endpoints a low-privileged user can target. The handler reuses the PAM provider service account context when establishing outbound authentication. Combined with missing destination validation, the server can be coerced into authenticating to an attacker-controlled host.

Attack Vector

An authenticated attacker with low privileges submits an AD browsing request that points to a host they control. The host runs a listener configured to capture inbound authentication exchanges, such as a rogue LDAP or SMB responder. The Devolutions Server initiates authentication using the stored PAM service account. The attacker captures the authentication material and can perform offline cracking or relay attacks against other services.

No verified proof-of-concept code is published. See the Devolutions Security Advisory DEVO-2026-0013 for vendor technical details.

Detection Methods for CVE-2026-7325

Indicators of Compromise

Outbound LDAP, LDAPS, or SMB connections from the Devolutions Server host to unexpected internal or external IP addresses.
Devolutions Server application logs showing AD browsing requests with non-standard or user-supplied directory endpoints.
Authentication events for the PAM provider service account originating from unusual destinations.
Repeated AD browsing operations issued by low-privileged user accounts.

Detection Strategies

Audit Devolutions Server logs for AD browsing actions and correlate the target host against an allow list of approved directory servers.
Monitor for service account authentication attempts terminating at non-domain hosts using Windows Security Event ID 4624 and 4625.
Inspect outbound network flows from the Devolutions Server for LDAP (389), LDAPS (636), and SMB (445) traffic to unsanctioned destinations.

Monitoring Recommendations

Enable verbose logging on Devolutions Server and forward events to a centralized logging platform for correlation.
Implement egress filtering on the Devolutions Server host and alert on any connection to non-approved directory endpoints.
Track usage patterns of stored PAM provider service accounts and alert on authentication attempts to unexpected systems.

How to Mitigate CVE-2026-7325

Immediate Actions Required

Upgrade Devolutions Server to a fixed release as listed in advisory DEVO-2026-0013.
Rotate credentials for any PAM provider service account stored in affected Devolutions Server instances.
Restrict access to the Active Directory browsing feature to administrative roles only.
Review audit logs for prior AD browsing activity initiated by low-privileged users.

Patch Information

Devolutions released fixed versions addressing CVE-2026-7325. Administrators should consult the Devolutions Security Advisory DEVO-2026-0013 for the exact patched version numbers and upgrade procedures. Versions 2026.1.6.0 through 2026.1.16.0 and 2025.3.20.0 and earlier require remediation.

Workarounds

Disable the Active Directory browsing feature until the server is upgraded.
Place the Devolutions Server in a network segment with strict egress controls that block outbound LDAP and SMB traffic to non-approved hosts.
Configure the PAM provider service account with the minimum directory privileges required and monitor its usage closely.
Require multifactor authentication for all Devolutions Server users to raise the bar for an attacker who must first authenticate.

bash

# Configuration example: restrict outbound LDAP/SMB from Devolutions Server host
# Windows Firewall outbound rule limiting LDAP to approved DCs only
New-NetFirewallRule -DisplayName "Block LDAP to non-approved hosts" `
  -Direction Outbound -Protocol TCP -RemotePort 389,636 `
  -RemoteAddress !10.0.0.10,!10.0.0.11 -Action Block

New-NetFirewallRule -DisplayName "Block SMB outbound to untrusted hosts" `
  -Direction Outbound -Protocol TCP -RemotePort 445 `
  -RemoteAddress !10.0.0.0/24 -Action Block