BaseFortify

Publication date: 2026-05-12

Last updated on: 2026-05-26

Assigner: Devolutions Inc.

Description

Missing authorization in the PAM module in Devolutions Server allows an authenticated user with a PAM license but no additional permissions to obtain OTP secret keys and recovery codes via crafted requests to PAM API endpoints. This issue affects the following versions : * Devolutions Server 2026.1.6.0 through 2026.1.11.0 * Devolutions Server 2025.3.16.0 and earlier

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-12

Last Modified

2026-05-26

Generated

2026-06-30

EPSS Evaluated

2026-06-28

NVD

CVE-2026-8407

Affected Vendors & Products

Vendor	Product	Version / Range
devolutions	devolutions_server	From 2026.1.6.0 (inc) to 2026.1.12.0 (exc)
devolutions	devolutions_server	to 2025.3.18.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions have not been generated yet.

Hi! I’m here to help you understand CVE-2026-8407. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70