Vulnerability Details CVE-2026-12755
Improper input validation in the PAM AD discovery endpoints in
Devolutions Server 2026.2.4.0 through 2026.2.7.0 allows an authenticated
user with the UserGroupsView permission to coerce server-side
authentication to an attacker-controlled host, exposing PAM provider
credentials as a NTLMv2 challenge-response, via a crafted DomainName
parameter.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 30.0%
CVSS Severity
CVSS v3 Score 2.7