All vulnerabilities
CVE-2026-114486

Incorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3.10.0  and earlier allows an authenticated non-administrative attacker to bypass the Network Access Rule

Devolutions Server
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.14%Chance of exploitation activity in the next 30 days, higher than 3% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2026.3.11Fixed versionCVE List
Published22 Oct 2026Updated 22 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Incorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3.10.0  and earlier allows an authenticated non-administrative attacker to bypass the Network Access Rules of a virtual gateway and reach denied hosts via wildcard additional destinations signed into the gateway token.

Text from CVE List

Affected versions 1

  • Serveraffected: all versions before 2026.3.11CVE List

References 1