CVE-2026-9047: Devolutions Server MFA Bypass Vulnerability

CVE-2026-9047 Overview

CVE-2026-9047 is an authentication bypass vulnerability in Devolutions Server. The flaw resides in the multi-factor authentication (MFA) management feature, which fails to properly handle factor key state when a user reconfigures their authentication factors. An attacker who already knows a target user's password can bypass that user's MFA after the user updates their factor configuration. The issue is tracked under CWE-305: Authentication Bypass by Primary Weakness and affects Devolutions Server versions 2026.1.6.0 through 2026.1.16.0.

Critical Impact
Attackers with valid credentials can defeat MFA protections on Devolutions Server accounts, gaining access to privileged credential vaults and remote connections managed by the platform.

Affected Products

Devolutions Server 2026.1.6.0
Devolutions Server versions between 2026.1.7.0 and 2026.1.15.0
Devolutions Server 2026.1.16.0

Discovery Timeline

2026-05-22 - CVE-2026-9047 published to NVD
2026-05-22 - Last updated in NVD database
2026-05-22 - Devolutions publishes advisory DEVO-2026-0013

Technical Details for CVE-2026-9047

Vulnerability Analysis

Devolutions Server is a self-hosted password and privileged access management platform. The MFA management feature lets users add, remove, or reconfigure second-factor authenticators such as time-based one-time password (TOTP) applications or hardware tokens. The vulnerability stems from improper handling of factor key state during this reconfiguration workflow. When a user updates their factor configuration, residual or stale key state remains usable for authentication. An attacker who has already obtained the user's password can leverage this stale state to complete login without satisfying a current, valid second factor.

The attack requires network access to the server, low privileges, and user interaction in the form of the legitimate user reconfiguring their factors. Successful exploitation compromises confidentiality and integrity of the targeted account and yields limited availability impact. Because Devolutions Server commonly stores administrator credentials, database secrets, and remote desktop sessions, account takeover can cascade into broader environment compromise.

Root Cause

The root cause is improper state management within the MFA factor key lifecycle. The application does not invalidate prior factor key material or session state when a user reconfigures factors. This leaves a window in which superseded factor state continues to satisfy the authentication challenge, violating the principle that primary authentication weaknesses should not enable bypass of secondary factors ([CWE-305]).

Attack Vector

Exploitation proceeds in three steps. First, the attacker obtains the victim's password through phishing, credential stuffing, or prior breach data. Second, the legitimate user reconfigures their MFA factors, which triggers the flawed state handling. Third, the attacker authenticates to the Devolutions Server web interface over the network and bypasses the MFA challenge using the stale factor key state. No code execution primitive is required; the bypass is a logic flaw in the authentication flow. No public proof-of-concept is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-9047

Indicators of Compromise

Authentication events for a user account where the MFA challenge is logged as satisfied without a corresponding recent TOTP or hardware token interaction.
Successful logins from new IP addresses or user agents shortly after an MFA reconfiguration event.
Access to credential entries, vaults, or remote sessions outside the user's typical behavior baseline.

Detection Strategies

Correlate Devolutions Server audit logs for MFA reconfiguration events with subsequent authentication events on the same account within a short time window.
Alert on Devolutions Server login success events that originate from IP addresses or geolocations not previously associated with the user.
Review privileged session launches and credential checkout actions following any MFA factor change.

Monitoring Recommendations

Forward Devolutions Server authentication, authorization, and audit logs to a centralized SIEM or data lake for long-term retention and correlation.
Monitor for repeated failed password attempts followed by a successful login on accounts that recently changed MFA factors.
Track administrative account activity continuously, including vault access, permission changes, and exports of stored credentials.

How to Mitigate CVE-2026-9047

Immediate Actions Required

Upgrade Devolutions Server to a fixed release listed in advisory DEVO-2026-0013.
Force a password reset for all users on affected versions and require re-enrollment of MFA factors after upgrading.
Audit recent authentication and vault access logs for accounts that performed MFA reconfiguration during the exposure window.

Patch Information

Devolutions has published security advisory DEVO-2026-0013 with fixed build information. Affected installations running Devolutions Server 2026.1.6.0 through 2026.1.16.0 must be upgraded to a vendor-supplied patched release. There is no in-product configuration toggle that resolves the underlying state-handling defect.

Workarounds

Restrict network access to the Devolutions Server administrative interface to trusted management networks or a VPN until patching completes.
Enforce strong, unique passwords and rotate credentials known or suspected to be exposed in third-party breaches to reduce the precondition of a known password.
Temporarily disable user-initiated MFA reconfiguration where operational policy permits, and require administrator-assisted factor changes with verification.

bash

# Configuration example: restrict Devolutions Server web access via firewall
# Replace 10.0.0.0/24 with your trusted management subnet
sudo iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/24 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 443 -j DROP