Improper MFA Bypass in Devolutions Server 2026.2.9.0

Executive Summary

This vulnerability in Devolutions Server versions 2026.2.4.0 through 2026.2.9.0 involves improper enforcement of a mandatory multi-factor authentication (MFA) policy.

An attacker who already has valid user credentials can bypass the MFA requirement and authenticate without completing the multi-factor authentication process.

The issue occurs when the server encounters an invalid default MFA value during authentication, which allows the bypass.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized access to your Devolutions Server by attackers who have valid user credentials but are not supposed to bypass multi-factor authentication.

Because MFA is bypassed, attackers can potentially access sensitive data or systems that rely on the server's authentication controls.

The vulnerability has a high severity with a CVSS score of 7.6, indicating a significant security risk.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an attacker with valid user credentials to bypass the mandatory multi-factor authentication (MFA) requirement, potentially leading to unauthorized access.

By enabling unauthorized access, this flaw could undermine security controls that are often required by common standards and regulations such as GDPR and HIPAA, which mandate strong authentication mechanisms to protect sensitive data.

Therefore, the improper enforcement of MFA may result in non-compliance with these regulations due to weakened access controls.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the vulnerability CVE-2026-14536 in Devolutions Server, you should upgrade your Devolutions Server to version 2026.2.11.0 or higher.

This update addresses the improper enforcement of the mandatory multi-factor authentication policy that allows attackers with valid credentials to bypass MFA.

Useful 0 Not Useful 0