Description
Improper neutralization of special elements in the built-in PAM provider password rotation templates in Devolutions Server allows an authenticated user with write access to a vault to execute arbitrary commands on the systems managed by the affected PAM provider. This issue affects : * Devolutions Server 2026.2.4.0 * Devolutions Server 2026.1.20.0 and earlier
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
Affected products
- Devolutions / Server2026.2.4.0 – 2026.2.4.0
- Devolutions / Server0 – 2026.1.20.0
References
- VENDOR_ADVISORYhttps://devolutions.net/security/advisories/DEVO-2026-0015/