Security Advisory

CVE-2026-12755

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-06-25 13:12:54

Last updated 2026-06-25 14:52:29

Assigner DEVOLUTIONS

CVSS score not scored

State PUBLISHED

Description

Improper input validation in the PAM AD discovery endpoints in Devolutions Server 2026.2.4.0 through 2026.2.7.0 allows an authenticated user with the UserGroupsView permission to coerce server-side authentication to an attacker-controlled host, exposing PAM provider credentials as a NTLMv2 challenge-response, via a crafted DomainName parameter.

← Browse all CVEs View on cve.org ↗