CVE-2026-93330: Devolutions Server PAM Auth Bypass Flaw

CVE-2026-93330 Overview

CVE-2026-93330 is an improper rule enforcement vulnerability in the Privileged Access Management (PAM) Active Directory provider within Devolutions Server 2026.3.5. A user granted PAM edit permissions can bypass the Devolutions Gateway host ruleset, gaining access to hosts that ruleset policy should restrict. The flaw is classified under CWE-696 (Incorrect Behavior Order) and is exploitable over the network by an authenticated low-privileged user without user interaction.

Critical Impact
Authenticated users with PAM edit permissions can circumvent Devolutions Gateway host-based access controls, undermining segmentation policies intended to constrain privileged access sessions.

Affected Products

Devolutions Server 2026.3.5
PAM Active Directory provider component
Deployments relying on Devolutions Gateway host rulesets for access restriction

Discovery Timeline

2026-09-29 - CVE-2026-93330 published to the National Vulnerability Database
2026-09-29 - Last updated in NVD database
2026-09-29 - Devolutions published security advisory DEVO-2026-0034

Technical Details for CVE-2026-93330

Vulnerability Analysis

The vulnerability resides in how the PAM Active Directory provider evaluates Devolutions Gateway host ruleset restrictions. Devolutions Gateway host rulesets are designed to constrain which target hosts a PAM session can reach. In the affected release, the Active Directory provider does not consistently enforce those rules for users who hold PAM edit permissions.

As a result, a low-privileged authenticated user with edit rights on PAM entries can initiate or configure operations that reach hosts outside the intended ruleset scope. The impact is scoped to confidentiality: the attacker gains visibility into resources the ruleset was designed to block, but the flaw does not itself modify data or degrade availability.

The issue is a policy enforcement bypass rather than a memory-safety or injection defect. It stems from the order in which authorization checks and provider actions execute, matching the CWE-696 pattern.

Root Cause

The PAM Active Directory provider does not evaluate the Devolutions Gateway host ruleset before permitting actions initiated by users with PAM edit permissions. Edit permissions were treated as sufficient authority, causing the provider to skip or misorder the host-restriction check.

Attack Vector

An attacker requires a valid Devolutions Server account with PAM edit permissions and network access to the server. No user interaction is required. Once authenticated, the attacker interacts with the PAM Active Directory provider to trigger operations against hosts that the Devolutions Gateway host ruleset should have blocked. See the Devolutions Security Advisory DEVO-2026-0034 for vendor technical details.

Detection Methods for CVE-2026-93330

Indicators of Compromise

PAM session logs showing connections from users with edit permissions to Active Directory hosts that fall outside the configured Devolutions Gateway host ruleset.
Devolutions Gateway audit entries where a PAM Active Directory provider request targets a host not present in the applicable allowlist.
Unexpected privileged credential checkouts or reveals for accounts scoped to restricted host groups.

Detection Strategies

Correlate Devolutions Server audit logs with Devolutions Gateway ruleset configuration to identify PAM operations that bypass host restrictions.
Baseline normal host targets per PAM editor and alert on deviations, particularly against high-value Active Directory tiers.
Review Active Directory authentication events for logons sourced from Devolutions Gateway that do not match approved PAM workflows.

Monitoring Recommendations

Enable verbose auditing on the PAM Active Directory provider and forward logs to a central analytics platform.
Monitor changes to PAM permissions, especially grants of edit rights, and require review of accounts that hold them.
Track Devolutions Gateway rule evaluations and flag operations that succeed against hosts marked as restricted.

How to Mitigate CVE-2026-93330

Immediate Actions Required

Review all Devolutions Server accounts holding PAM edit permissions and revoke rights that are not operationally required.
Audit Devolutions Gateway host rulesets and confirm they align with current segmentation policy.
Apply the fixed release referenced in Devolutions Security Advisory DEVO-2026-0034 as soon as it is available in your change window.

Patch Information

Devolutions addresses the issue in advisory DEVO-2026-0034. Administrators running Devolutions Server 2026.3.5 should consult the vendor advisory for the fixed version and upgrade guidance. No workaround replaces the vendor patch.

Workarounds

Restrict PAM edit permissions to a minimal set of trusted administrators until the patch is deployed.
Enforce host-level access controls at the network layer (firewalls, segmentation) so that Devolutions Gateway is not the sole control preventing unauthorized host access.
Increase audit review frequency for PAM Active Directory provider activity during the exposure window.

bash

# Configuration example
# Review users with PAM edit permissions in Devolutions Server
# and validate that Devolutions Gateway host rulesets are enforced.
# Refer to the vendor advisory DEVO-2026-0034 for upgrade steps.